GHSA-w37g-rhq8-7m4j
Snakeyaml vulnerable to Stack overflow leading to denial of service
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2022-41854
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Description
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.yaml:snakeyaml | introduced 0, fixed 1.32 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2022-41854 ADVISORY
- https://bitbucket.org/snakeyaml/snakeyaml PACKAGE
- https://bitbucket.org/snakeyaml/snakeyaml/commits/e230a1758842beec93d28eddfde568c21774780a WEB
- https://bitbucket.org/snakeyaml/snakeyaml/issues/531 WEB
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355 WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J WEB
- https://security.netapp.com/advisory/ntap-20240315-0009 WEB
- https://security.netapp.com/advisory/ntap-20240621-0006 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |