CVE-2022-25857

2022-08-3005:15:07

CWE-776

[email protected]

web.nvd.nist.gov

org.yaml:snakeyaml

package vulnerability

denial of service

dos

nested depth limitation

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

55.6%

JSON

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Affected configurations

Nvd

Node

snakeyaml_projectsnakeyamlRange<1.31

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
snakeyaml_projectsnakeyaml*cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
snakeyaml_project	snakeyaml	*	cpe:2.3:a:snakeyaml_project:snakeyaml::::::::
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*