snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write

🗓️ 06 Sep 2022 00:00:27Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 75 Views

snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Writ

Reporter	Title	Published	Views	Family All 132
IBM Security Bulletins	Security Bulletin: Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for Febuary 2023	10 Mar 202318:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® Graph	24 Apr 202322:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Axis, Apache Shiro and SnakeYAML affect IBM WebSphere Service Registry and Repository	5 Mar 202416:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting (CVE-2023-38722)	6 Dec 202405:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in snakeYAML	14 Jul 202321:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are reported for snakeyaml and jackson-databind in IBM Business Automation Workflow	28 Feb 202307:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	26 Mar 202503:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple CVEs affect IBM Integration Designer	1 Feb 202319:40	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties in Open Source packages affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities	28 Jul 202301:39	–	ibm

Vulners

Node

pl.droidsonroids.yaml snakeyamlRange≤1.18.2maven

OR

org.testifyproject.external external-snakeyamlRange≤1.0.6maven

OR

io.prometheus.jmx jmx_prometheus_httpserver_java6Range≤0.18.0maven

OR

io.prometheus.jmx jmx_prometheus_httpservermaven

OR

com.alipay.sofa.acts acts-common-utilmaven

OR

be.cylab snakeyamlmaven

OR

org.yaml snakeyamlRange<1.31maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-38749
bitbucket	www.bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open
bugs	www.bugs.chromium.org/p/oss-fuzz/issues/detail
lists	www.lists.debian.org/debian-lts-announce/2022/10/msg00001.html
security	www.security.gentoo.org/glsa/202305-28
arxiv	www.arxiv.org/pdf/2306.05534.pdf
security	www.security.netapp.com/advisory/ntap-20240315-0010
github	www.github.com/advisories/GHSA-c4r9-r8fh-9vj2

15 Mar 2024 12:30Current

7.2High risk

Vulners AI Score7.2

CVSS 3.16.5

EPSS0.00533

CWE-121 CWE-787

snakeyaml software denial of service out-of-bounds write yaml files parser untrusted input stackoverflow