[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnv-BrpwPBuOwvIKqheJKMdbUt2jqMb3_Y5PFpQnbmhg":3,"g5a-risk:CVE-2017-18640":311},{"success":4,"data":5,"meta":309},true,{"cveId":6,"title":7,"description":8,"shortDescription":8,"publishedDate":9,"lastModified":10,"cvssScore":11,"cvssVector":12,"cvssMetrics":13,"epssScore":38,"epssPercentile":25,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":69,"references":70,"referencesCount":228,"weaknesses":229,"weaknessesCount":238,"isActivelyExploited":239,"cisaInfo":25,"otxData":25,"relatedBlogPosts":240,"seoMetadata":241,"configurations":266,"relatedVendorCves":300,"notableEvents":301},"CVE-2017-18640","What is CVE-2017-18640?","The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","2019-12-12T03:15:10.85","2023-11-07T02:41:56.603",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":14,"CVSSMetricV30":25,"CVSSMetricV2":28,"CVSSMetricV40":25},[15],{"Source":16,"Type":17,"CVSSData":18,"ExploitabilityScore":26,"ImpactScore":27},"nvd@nist.gov","Primary",{"Version":19,"VectorString":12,"AttackVector":20,"AttackComplexity":21,"PrivilegesRequired":22,"UserInteraction":22,"Scope":23,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":24,"BaseScore":11,"BaseSeverity":24,"ExploitCodeMaturity":25,"RemediationLevel":25,"ReportConfidence":25,"TemporalScore":25,"TemporalSeverity":25,"ConfidentialityRequirement":25,"IntegrityRequirement":25,"AvailabilityRequirement":24,"ModifiedAttackVector":25,"ModifiedAttackComplexity":25,"ModifiedPrivilegesRequired":25,"ModifiedUserInteraction":25,"ModifiedScope":25,"ModifiedConfidentialityImpact":25,"ModifiedIntegrityImpact":25,"ModifiedAvailabilityImpact":25,"EnvironmentalScore":25,"EnvironmentalSeverity":25},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,[29],{"Source":16,"Type":17,"CVSSData":30,"BaseSeverity":35,"ExploitabilityScore":36,"ImpactScore":37,"ACInsufInfo":25,"ObtainAllPrivilege":25,"ObtainUserPrivilege":25,"ObtainOtherPrivilege":25,"UserInteractionRequired":25},{"Version":31,"VectorString":32,"AccessVector":20,"AccessComplexity":21,"Authentication":22,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":33,"BaseScore":34,"BaseSeverity":25,"Exploitability":25,"RemediationLevel":25,"ReportConfidence":25,"TemporalScore":25,"CollateralDamagePotential":25,"TargetDistribution":25,"ConfidentialityRequirement":25,"IntegrityRequirement":25,"AvailabilityRequirement":25,"EnvironmentalScore":25},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:N\u002FI:N\u002FA:P","PARTIAL",5,"MEDIUM",10,2.9,0.26723,[38,38,38,38,38,38,38],"High",[42,47,52,55,58,63,66],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"snakeyaml_project","snakeyaml","*","cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*",{"vendor":48,"product":49,"version":50,"criteria":51,"vulnerable":4},"fedoraproject","fedora","31","cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",{"vendor":48,"product":49,"version":53,"criteria":54,"vulnerable":4},"32","cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",{"vendor":56,"product":56,"version":45,"criteria":57,"vulnerable":4},"quarkus","cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",{"vendor":59,"product":60,"version":61,"criteria":62,"vulnerable":4},"oracle","peoplesoft_enterprise_pt_peopletools","8.56","cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.56:*:*:*:*:*:*:*",{"vendor":59,"product":60,"version":64,"criteria":65,"vulnerable":4},"8.57","cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:*",{"vendor":59,"product":60,"version":67,"criteria":68,"vulnerable":4},"8.58","cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:*",7,[71,79,82,85,89,93,96,99,102,105,108,111,114,117,120,123,126,129,132,135,138,141,144,147,150,153,156,159,162,165,168,171,174,177,180,183,186,189,192,195,198,201,204,207,210,213,216,219,222,225],{"url":72,"source":73,"tags":74},"https:\u002F\u002Fbitbucket.org\u002Fasomov\u002Fsnakeyaml\u002Fissues\u002F377\u002Fallow-configuration-for-preventing-billion","Bitbucket",[75,76,77,78],"Exploit","Issue Tracking","Patch","Third Party Advisory",{"url":80,"source":73,"tags":81},"https:\u002F\u002Fbitbucket.org\u002Fasomov\u002Fsnakeyaml\u002Fwiki\u002FBillion%20laughs%20attack",[78],{"url":83,"source":73,"tags":84},"https:\u002F\u002Fbitbucket.org\u002Fsnakeyaml\u002Fsnakeyaml\u002Fissues\u002F377",[75,76,78],{"url":86,"source":73,"tags":87},"https:\u002F\u002Fbitbucket.org\u002Fsnakeyaml\u002Fsnakeyaml\u002Fwiki\u002FChanges",[88,78],"Release Notes",{"url":90,"source":91,"tags":92},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr1058e7646988394de6a3fd0857ea9b1ee0de14d7bb28fee5ff782457%40%3Ccommits.atlas.apache.org%3E","Apache",[],{"url":94,"source":91,"tags":95},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr154090b871cf96d985b90864442d84eb027c72c94bc3f0a5727ba2d1%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":97,"source":91,"tags":98},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr16ae4e529401b75a1f5aa462b272b31bf2a108236f882f06fddc14bc%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":100,"source":91,"tags":101},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr1703a402f30c8a2ee409f8c6f393e95a63f8c952cc9ee5bf9dd586dc%40%3Ccommits.cassandra.apache.org%3E",[],{"url":103,"source":91,"tags":104},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr182e9cf6f3fb22b9be0cac4ff0685199741d2ab6e9a4e27a3693c224%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":106,"source":91,"tags":107},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr191ceadb1b883357384981848dfa5235cb02a90070c553afbaf9b3d9%40%3Ccommits.cassandra.apache.org%3E",[],{"url":109,"source":91,"tags":110},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr1aab47b48a757c70e40fc0bcb1fcf1a3951afa6a17aee7cd66cf79f8%40%3Ccommon-commits.hadoop.apache.org%3E",[],{"url":112,"source":91,"tags":113},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr1dfac8b6a7097bcb4979402bbb6e2f8c36d0d9001e3018717eb22b7e%40%3Cdev.atlas.apache.org%3E",[],{"url":115,"source":91,"tags":116},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr1ffce2ed3017e9964f03ad2c539d69e49144fc8e9bf772d641612f98%40%3Ccommits.cassandra.apache.org%3E",[],{"url":118,"source":91,"tags":119},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr20350031c60a77b45e0eded33e9b3e9cb0cbfc5e24e1c63bf264df12%40%3Ccommits.cassandra.apache.org%3E",[],{"url":121,"source":91,"tags":122},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr22ac2aa053b7d9c6b75a49db78125c9316499668d0f4a044f3402e2f%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":124,"source":91,"tags":125},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E",[],{"url":127,"source":91,"tags":128},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr28c9009a48d52cf448f8b02cd823da0f8601d2dff4d66f387a35f1e0%40%3Cdev.atlas.apache.org%3E",[],{"url":130,"source":91,"tags":131},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr2a5b84fdf59042dc398497e914b5bb1aed77328320b1438144ae1953%40%3Cdev.atlas.apache.org%3E",[],{"url":133,"source":91,"tags":134},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr2b05744c0c2867daa5d1a96832965b7d6220328b0ead06c22a6e7854%40%3Ccommits.pulsar.apache.org%3E",[],{"url":136,"source":91,"tags":137},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr2db207a2431a5e9e95e899858ab1f5eabd9bcc790a6ca7193ae07e94%40%3Cdev.atlas.apache.org%3E",[],{"url":139,"source":91,"tags":140},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr436988d2cfe8a770ae361c82b181c5b2bf48a249bad84d8a55a3b46e%40%3Cdev.phoenix.apache.org%3E",[],{"url":142,"source":91,"tags":143},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr465d2553a31265b042cf5457ef649b71e0722ab89b6ea94a5d59529b%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":145,"source":91,"tags":146},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr4c682fb8cf69dd14162439656a6ebdf42ea6ad0e4edba95907ea3f14%40%3Ccommits.servicecomb.apache.org%3E",[],{"url":148,"source":91,"tags":149},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr4d7f37da1bc2df90a5a0f56eb7629b5ea131bfe11eeeb4b4c193f64a%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":151,"source":91,"tags":152},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr5510f0125ba409fc1cabd098ab8b457741e5fa314cbd0e61e4339422%40%3Cdev.atlas.apache.org%3E",[],{"url":154,"source":91,"tags":155},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr55d807f31e64a080c54455897c20b1667ec792e5915132c7b7750533%40%3Ccommits.cassandra.apache.org%3E",[],{"url":157,"source":91,"tags":158},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr56805265475919252ba7fc10123f15b91097f3009bae86476624ca25%40%3Ccommits.cassandra.apache.org%3E",[],{"url":160,"source":91,"tags":161},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr643ba53f002ae59068f9352fe1d82e1b6f375387ffb776f13efe8fda%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":163,"source":91,"tags":164},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr666f29a7d0e1f98fa1425ca01efcfa86e6e3856e01d300828aa7c6ea%40%3Ccommits.pulsar.apache.org%3E",[],{"url":166,"source":91,"tags":167},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr6c91e52b3cc9f4e64afe0f34f20507143fd1f756d12681a56a9b38da%40%3Ccommits.pulsar.apache.org%3E",[],{"url":169,"source":91,"tags":170},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr6d54c2da792c74cc14b9b7665ea89e144c9e238ed478d37fd56292e6%40%3Cdev.atlas.apache.org%3E",[],{"url":172,"source":91,"tags":173},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr72a3588d62b2de1361dc9648f5d355385735e47f7ba49d089b0e680d%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":175,"source":91,"tags":176},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr7ce3de03facf7e7f3e24fc25d26d555818519dafdb20f29398a3414b%40%3Cdev.phoenix.apache.org%3E",[],{"url":178,"source":91,"tags":179},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr8464b6ec951aace8c807bac9ea526d4f9e3116aa16d38be06f7c6524%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":181,"source":91,"tags":182},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr8b57c57cffa01e418868a3c7535b987635ff1fb5ab534203bfa2d64a%40%3Ccommits.pulsar.apache.org%3E",[],{"url":184,"source":91,"tags":185},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr900e020760c89f082df1c6e0d46320eba721e4e47bb9eb521e68cd95%40%3Ccommits.servicecomb.apache.org%3E",[],{"url":187,"source":91,"tags":188},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fraebd2019b3da8c2f90f31e8b203b45353f78770ca93bfe5376f5532e%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":190,"source":91,"tags":191},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frb0e033d5ec8233360203431ad96580cf2ec56f47d9a425d894e279c2%40%3Cpr.cassandra.apache.org%3E",[],{"url":193,"source":91,"tags":194},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frb34d8d3269ad47a1400f5a1a2d8310e13a80b6576ebd7f512144198d%40%3Ccommon-dev.hadoop.apache.org%3E",[],{"url":196,"source":91,"tags":197},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frb5c33d0069c927fae16084f0605895b98d231d7c48527bcb822ac48c%40%3Ccommits.cassandra.apache.org%3E",[],{"url":199,"source":91,"tags":200},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frb7b28ac741e32dd5edb2c22485d635275bead7290b056ee56baf8ce0%40%3Cdev.atlas.apache.org%3E",[],{"url":202,"source":91,"tags":203},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frbaa1f513d903c89a08267c91d86811fa5bcc82e0596b6142c5cea7ea%40%3Ccommits.cassandra.apache.org%3E",[],{"url":205,"source":91,"tags":206},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frc3211c71f7e0973a1825d1988a3921288c06cd9d793eae97ecd34948%40%3Ccommits.cassandra.apache.org%3E",[],{"url":208,"source":91,"tags":209},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frcb2a7037366c58bac6aec6ce3df843a11ef97ae4eb049f05f410eaa5%40%3Ccommon-commits.hadoop.apache.org%3E",[],{"url":211,"source":91,"tags":212},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frcb4b61dbe2ed1c7a88781a9aff5a9e7342cc7ed026aec0418ee67596%40%3Ccommon-issues.hadoop.apache.org%3E",[],{"url":214,"source":91,"tags":215},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frce5c93bba6e815fb62ad38e28ca1943b3019af1eddeb06507ad4e11a%40%3Ccommits.atlas.apache.org%3E",[],{"url":217,"source":91,"tags":218},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frd582c64f66c354240290072f340505f5d026ca944ec417226bb0272e%40%3Ccommits.cassandra.apache.org%3E",[],{"url":220,"source":91,"tags":221},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frdd34c0479587e32a656d976649409487d51ca0d296b3e26b6b89c3f5%40%3Ccommon-commits.hadoop.apache.org%3E",[],{"url":223,"source":91,"tags":224},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fre791a854001ec1f79cd4f47328b270e7a1d9d7056debb8f16d962722%40%3Cdev.atlas.apache.org%3E",[],{"url":226,"source":91,"tags":227},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fre851bbfbedd47c690b6e01942acb98ee08bd00df1a94910b905bc8cd%40%3Cdev.atlas.apache.org%3E",[],50,[230],{"id":231,"name":232,"description":233,"extendedDescription":234,"status":235,"abstraction":236,"structure":237},"CWE-776","Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.","If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.","Draft","Base","Simple",1,false,[],{"title":242,"metaDescription":243,"keywords":244,"canonicalUrl":245,"structuredData":246},"What is CVE-2017-18640? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2017-18640, a high severity cyber security vulnerability from 2019. The Alias feature in SnakeYAML before 1.26 allows entity ex...","CVE-2017-18640, CVE-2017-18640 vulnerability, CVE-2017-18640 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2019, CVSS score, exploit, patch, remediation, snakeyaml_project security, fedoraproject security, quarkus security, oracle security, snakeyaml vulnerability, fedora vulnerability, quarkus vulnerability, peoplesoft_enterprise_pt_peopletools vulnerability","\u002Fwhat-is\u002Fcve-2017-18640",{"@context":247,"@type":248,"headline":242,"description":243,"datePublished":9,"dateModified":10,"author":249,"publisher":253,"about":257,"mainEntityOfPage":261,"articleSection":264,"keywords":265},"https:\u002F\u002Fschema.org","TechArticle",{"@type":250,"name":251,"url":252},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":250,"name":251,"url":252,"logo":254},{"@type":255,"url":256},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":258,"name":6,"description":259,"additionalType":260},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":262,"@id":263},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2017-18640","Cybersecurity","CVE-2017-18640, CVE-2017-18640 vulnerability, CVE-2017-18640 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[267,275,283,290],{"Operator":25,"Negate":25,"Nodes":268},[269],{"Operator":270,"Negate":25,"CPEMatch":271},"OR",[272],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":273,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":274,"VersionEndIncluding":25},"B5ACA011-C76B-4D54-8DF1-0DCA569EDAA4","1.26",{"Operator":25,"Negate":25,"Nodes":276},[277],{"Operator":270,"Negate":25,"CPEMatch":278},[279,281],{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":280,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"80F0FA5D-8D3B-4C0E-81E2-87998286AF33",{"Vulnerable":4,"Criteria":54,"MatchCriteriaID":282,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"36D96259-24BD-44E2-96D9-78CE1D41F956",{"Operator":25,"Negate":25,"Nodes":284},[285],{"Operator":270,"Negate":25,"CPEMatch":286},[287],{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":288,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":289},"06CD704F-068A-4365-88DD-9ABE77BE8D72","1.3.4",{"Operator":25,"Negate":25,"Nodes":291},[292],{"Operator":270,"Negate":25,"CPEMatch":293},[294,296,298],{"Vulnerable":4,"Criteria":62,"MatchCriteriaID":295,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"CEB3BE9F-44AC-4EE0-9E66-2B72CF4AF0F5",{"Vulnerable":4,"Criteria":65,"MatchCriteriaID":297,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"99BA317E-3C52-4BAF-B61C-803B7208C155",{"Vulnerable":4,"Criteria":68,"MatchCriteriaID":299,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"929638B0-AAD1-4326-9549-2FA8D03AA7ED",[],[302],{"id":303,"eventType":304,"eventTime":305,"details":306,"label":307,"color":308},"dcc7a68b-e0fc-45b0-97e2-cec6122a7734","HIGH_EPSS_DELTA","2026-06-16T04:06:23.488256+00:00","Daily EPSS score increased by 0.231 on 2023-12-30","EPSS Score Increased","red",{"lastModified":10,"cacheTime":310,"version":31},1792241898756,{"score":228,"band":312,"action":313,"scoredAt":314},"Medium","Plan remediation","2026-10-16T06:47:27.458969+00:00"]