CVE-2022-25857

🗓️ 30 Aug 2022 05:05:11Reported by snykType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 649 Views

The org.yaml:snakeyaml package before 1.31 is vulnerable to DoS due to missing nested depth limitation

Reporter	Title	Published	Views	Family All 223
IBM Security Bulletins	Security Bulletin: Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for Febuary 2023	10 Mar 202318:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® Graph	24 Apr 202322:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Axis, Apache Shiro and SnakeYAML affect IBM WebSphere Service Registry and Repository	5 Mar 202416:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	20 Aug 202502:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source software used by Cloud Pak System	31 Mar 202314:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in snakeYAML	14 Jul 202321:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are reported for snakeyaml and jackson-databind in IBM Business Automation Workflow	28 Feb 202307:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	26 Mar 202503:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple CVEs affect IBM Integration Designer	1 Feb 202319:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to Denial of Service due to snake-yaml (CVE-2022-25857)	17 Dec 202514:05	–	ibm

NVD

Node

snakeyaml_project snakeyamlRange<1.31

Node

debian debian_linuxMatch10.0

[
  {
    "vendor": "n/a",
    "product": "org.yaml:snakeyaml",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "1.31",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2022/10/msg00001.html
github	www.github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174
security	www.security.netapp.com/advisory/ntap-20240315-0010/
bitbucket	www.bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174
bitbucket	www.bitbucket.org/snakeyaml/snakeyaml/issues/525
security	www.security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360

21 Nov 2024 06:53Current

8.8High risk

Vulners AI Score8.8

CVSS 3.17.5

EPSS0.0292

CWE-776