Deserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider
High severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Jan 30, 2023
Package
Affected versions
< 3.0.26.Final
>= 3.1.0, < 3.6.0.Final
Patched versions
3.0.26.Final
3.6.0.Final
Description
Published by the National Vulnerability Database
Jan 25, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Nov 1, 2022
Last updated
Jan 30, 2023
It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via
Yaml.load()in YamlProvider.Mitigation:
If the YamlProvider is enabled it's recommended to add authentication, and authorization to the endpoint expecting Yaml content to prevent exploitation of this vulnerability.
References