CVE-2022-1471
Remote Code execution in SnakeYAML
Summary
Remote Code execution in SnakeYAML
Original description
The description as published by the source.
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.yaml:snakeyaml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-1471 snakeyaml
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- advisory security.netapp.com
- advisory security.netapp.com
- package github.com
- package bitbucket.org
- web github.com
- web snyk.io
- web security.netapp.com
- web security.netapp.com
- web infosecwriteups.com
- web groups.google.com
- web confluence.atlassian.com
- web bitbucket.org
- web bitbucket.org
- web bitbucket.org
- web bitbucket.org
- web bitbucket.org
- web bitbucket.org
- web packetstormsecurity.com
- web openwall.com