Description
It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | resteasy | after 3.0.22, after 3.1.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | resteasy | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.resteasy:resteasy-yaml-provider | < 3.0.26.Final | 3.0.26.Final | GHSA-m2fv-3rqm-g7p5 |
| Maven | org.jboss.resteasy:resteasy-yaml-provider | >= 3.1.0, < 3.6.0.Final | 3.6.0.Final | GHSA-m2fv-3rqm-g7p5 |