Red Hat Security Advisory: prometheus-jmx-exporter security update

Fixed packages 1

Vulnerabilities 1

• High 7.5
  CVE-2017-18640 EPSS 27%

  SnakeYAML Entity Expansion during load operation

  The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

  org.yaml:snakeyaml snakeyaml snakeyaml Debian Ubuntu Maven
  Dec 12, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1785376
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4807.json
• report
  https://access.redhat.com/security/cve/CVE-2017-18640
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-18640
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-18640