CVE-2023-47163: 
Python vulnerability analysis and mitigation

Remarshal prior to version 0.17.1 contains a vulnerability where it expands YAML alias nodes unlimitedly, making it susceptible to the Billion Laughs Attack. The vulnerability was discovered by Taichi Kotake of Sterra Security Co.,Ltd. / Akatsuki Games Inc. and was assigned CVE-2023-47163. The issue was reported through JPCERT/CC and affects all versions of Remarshal before v0.17.1 (JPCERT Advisory).

The vulnerability is classified as CWE-674 (Uncontrolled Recursion) and received a CVSS v3.1 base score of 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue stems from the software's handling of YAML alias nodes, where it fails to limit the maximum number of nodes during expansion, leading to potential denial-of-service conditions when processing maliciously crafted YAML files (NVD).

When processing untrusted YAML files, the vulnerability can lead to a denial-of-service (DoS) condition due to unlimited expansion of YAML alias nodes. This can cause system resource exhaustion through the Billion Laughs Attack pattern (JPCERT Advisory).

The vulnerability has been fixed in Remarshal version 0.17.1. Users should update to this version or later to address the security issue. The fix implements a limit on the maximum number of nodes that can be processed, preventing the Billion Laughs Attack (GitHub Commit).