Remote Code execution in SnakeYAML
Résumé
Remote Code execution in SnakeYAML
Description d'origine
La description telle que publiée par la source (souvent en anglais).
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-1471 snakeyaml
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- advisory security.netapp.com
- advisory security.netapp.com
- package github.com
- package bitbucket.org
- web github.com
- web snyk.io
- web security.netapp.com
- web security.netapp.com
- web infosecwriteups.com
- web groups.google.com
- web confluence.atlassian.com
- web bitbucket.org
- web bitbucket.org
- web bitbucket.org
- web bitbucket.org
- web bitbucket.org
- web bitbucket.org
- web packetstormsecurity.com
- web openwall.com