CVE-2022-38749
DoS in SnakeYAML
Summary
DoS in SnakeYAML
Original description
The description as published by the source.
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.yaml:snakeyaml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31"}]}]
Maven
be.cylab:snakeyaml
Maven
com.alipay.sofa.acts:acts-common-util
Maven
io.prometheus.jmx:jmx_prometheus_httpserver
Maven
io.prometheus.jmx:jmx_prometheus_httpserver_java6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.18.0"}]}]
Maven
org.testifyproject.external:external-snakeyaml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.6"}]}]
Maven
pl.droidsonroids.yaml:snakeyaml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.18.2"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-38749 snakeyaml Fixed in: 1.28-1+deb11u1
References
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory github.com
- advisory security.netapp.com
- package bitbucket.org
- web arxiv.org
- web bitbucket.org
- web bugs.chromium.org
- web lists.debian.org
- web security.netapp.com