RHLW-2026-48331bcb39d8ac49: Lightwell Security Advisory: yamlbeans 1.13.0.rhlw-00005
Red Hat Lightwell has released com.esotericsoftware.yamlbeans:yamlbeans 1.13.0.rhlw-00005 with backported fixes for CVE-2023-24620 and CVE-2023-24621.
CVE-2023-24620: An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.
CVE-2023-24621: An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.
This patched artifact is a drop-in replacement for com.esotericsoftware.yamlbeans:yamlbeans 1.13.0 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/com.esotericsoftware.yamlbeans:yamlbeansto a version that resolves this vulnerability.Fixed in 1.13.0.rhlw-00005 - Upgrade
Upgrade
com.esotericsoftware.yamlbeans:yamlbeansto a version that resolves this vulnerability.Fixed in 1.13.0.rhlw-00005
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What deployments are realistically exposed to these issues?
Deployments are exposed when they use YamlBeans to process YAML documents supplied or controlled by an untrusted party. The entity-expansion issue affects YamlReader processing of crafted YAML, while the deserialization issue involves YAML whose data and target Java class are controlled by the document author.
Does exploitation require prior authentication or special application configuration?
The provided CVSS vector indicates local attack access, low attack complexity, no privileges required, and user interaction required. The deserialization issue is described as allowing untrusted deserialization to Java classes by default.
What is the practical impact of the YAML anchor expansion issue?
A small crafted YAML document can expand to a large size through YAML anchors, consuming CPU and memory. This can result in conditions such as a Java Out-of-Memory exception and loss of availability.
What replacement is available for users of the Maven Central 1.13.0 artifact?
Red Hat Lightwell released com.esotericsoftware.yamlbeans:yamlbeans 1.13.0.rhlw-00005 with backported fixes for CVE-2023-24620 and CVE-2023-24621. It is described as a drop-in replacement for com.esotericsoftware.yamlbeans:yamlbeans 1.13.0 from Maven Central.