CVE-2018-16848: 
Python vulnerability analysis and mitigation

A Denial of Service (DoS) vulnerability was discovered in OpenStack Mistral versions up to and including 7.0.3, identified as CVE-2018-16848. The vulnerability was reported on August 6, 2018, and allows attackers to cause resource exhaustion by submitting specially crafted workflow definition YAML files containing nested anchors (Launchpad Bug, NVD).

The vulnerability exploits YAML anchor expansion functionality, similar to an XML Entity Expansion attack (also known as the Billion Laughs attack). When processing workflow definition files, Mistral fails to properly handle nested YAML anchors, which can lead to exponential expansion of the input data and subsequent resource exhaustion. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a denial of service condition in the Mistral server through resource exhaustion. The attack specifically affects the service's ability to process workflow definitions, potentially making the service unavailable to legitimate users (Launchpad Bug).

The vulnerability can be exploited by an authenticated user who has the ability to submit workflow definitions to the Mistral service. The attack requires submitting a specially crafted YAML file that contains nested anchors designed to trigger exponential expansion during parsing (Launchpad Bug).

The issue was fixed by disabling the use of anchors when parsing YAML files. The fix has been implemented across multiple OpenStack releases including Rocky, Stein, and Train branches. Users should upgrade to patched versions of Mistral that include this security fix (Launchpad Bug).