Bug in Apache Submarine's YAML Serialization Using snakeyaml

CVE-2023-46302

Summary

Apache Submarine contains a vulnerability related to improper YAML deserialization that arises from the use of SnakeYAML. The vulnerability is manifested when handling incoming requests using application/yaml content-type through the YamlEntityProvider entity provider. Specifically, an error occurs in the readFrom method, which processes user-supplied YAML data. This issue affects versions of Apache Submarine prior to 0.8.0. To remediate the vulnerability, users should upgrade to Apache Submarine version 0.8.0 or later. Alternatively, for users who cannot upgrade, a temporary fix can be applied by cherry-picking a patch from the project's repository and rebuilding the submarine-server image.

References