CVE-2022-41854 Stack Overflow in Snakeyaml

2022-11-1100:00:00

CWE-121

Google

www.cve.org

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.8%

JSON

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.

CNA Affected

[
  {
    "vendor": "SnakeYaml",
    "product": "SnakeYaml",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "1.32",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]