CVE-2017-18640: Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion)

December 12, 2019 (updated March 31, 2022)

SnakeYAML allows entity expansion during a load operation.

References

bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion
mvnrepository.com/artifact/org.yaml/snakeyaml/1.25/usages
nvd.nist.gov/vuln/detail/CVE-2017-18640

Detect and mitigate CVE-2017-18640 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →