Ubuntu 7368-1: SnakeYAML Security Advisory Updates
ubuntu
March 27, 2025
SnakeYAML could be made to crash if it received specially crafted input.
Summary
SnakeYAML could be made to crash if it received specially crafted
input.
Software Description:
- snakeyaml: YAML parser and emitter for the Java programming language
Details:
It was discovered that SnakeYAML incorrectly handled recursive
entity references. An attacker could possibly use this issue to
cause SnakeYAML to crash, resulting in a denial of service.
Topics Covered
Update Instructions
The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS libyaml-snake-java 1.25+ds-2ubuntu0.1+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libyaml-snake-java 1.23-1+deb10u1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libyaml-snake-java 1.12-2ubuntu0.16.04.1~esm2 Available with Ubuntu Pro Ubuntu 14.04 LTS libyaml-snake-java 1.12-2ubuntu0.14.04.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
References
https://ubuntu.com/security/notices/USN-7368-1
CVE-2017-18640
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Ubuntu Security Notice USN-7368-1
Topics Covered
Package Information
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!