HIGH7.5

PYSEC-2023-236

Quick fix

PYSEC-2023-236 — remarshal: upgrade to the fixed version with the command below.

pip install --upgrade 'remarshal>=fd6ac799a02f533c3fc243b49cdd6d21aa7ee494'

Details

Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/remarshal

Introduced in: 0Fixed in: fd6ac799a02f533c3fc243b49cdd6d21aa7ee494

Fixpip install --upgrade 'remarshal>=fd6ac799a02f533c3fc243b49cdd6d21aa7ee494'

References

https://github.com/remarshal-project/remarshal/releases/tag/v0.17.1[WEB]
https://github.com/remarshal-project/remarshal/commit/fd6ac799a02f533c3fc243b49cdd6d21aa7ee494[FIX]
https://jvn.jp/en/jp/JVN86156389/[WEB]
https://github.com/advisories/GHSA-gw7g-qr8w-3448[ADVISORY]