CVE-2022-38752
snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write
Résumé
snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DoS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.yaml:snakeyaml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-38752 snakeyaml
Références
- advisory nvd.nist.gov
- package bitbucket.org
- web bitbucket.org
- web bugs.chromium.org
- web security.gentoo.org
- web security.netapp.com