Lucene search
HistorySep 05, 2022 - 10:15 a.m.
CVE-2022-38752
snakeyaml
yaml parsing
denial of service
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
0.003
Percentile
69.6%
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
Affected configurations
Node
snakeyaml_projectsnakeyamlRange<1.32
| Vendor | Product | Version | CPE |
|---|---|---|---|
| snakeyaml_project | snakeyaml | * | cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:* |
Related
nessus
nessus
Amazon Linux 2 : snakeyaml (ALAS-2024-2450)
2024-02-06 00:00:00
Amazon Linux 2023 : snakeyaml, snakeyaml-javadoc (ALAS2023-2023-375)
2023-10-03 00:00:00
RHEL 7 : snakeyaml (Unpatched Vulnerability)
2024-05-11 00:00:00
ibm
ibm
ubuntucve
ubuntucve
CVE-2022-38752
2022-09-05 00:00:00
github
github
osv
osv
CVE-2022-38752
2022-09-05 10:15:09
cvelist
cvelist
CVE-2022-38752 DoS in SnakeYAML
2022-09-05 00:00:00
redhatcve
redhatcve
CVE-2022-38752
2022-09-26 06:19:00
debiancve
debiancve
CVE-2022-38752
2022-09-05 10:15:09
prion
prion
Stack overflow
2022-09-05 10:15:00
amazon
amazon
Low: snakeyaml
2024-02-01 19:57:00
vulnrichment
vulnrichment
CVE-2022-38752 DoS in SnakeYAML
2022-09-05 00:00:00
veracode
veracode
Denial Of Service (DoS)
2022-09-06 09:31:37
cbl_mariner
cbl_mariner
CVE-2022-38752 affecting package snakeyaml 1.25-2
2024-09-27 09:12:43
cve
cve
CVE-2022-38752
2022-09-05 10:15:09
gentoo
gentoo
snakeyaml: Multiple Vulnerabilities
2023-05-21 00:00:00
redhat
redhat
openvas
openvas
openSUSE: Security Advisory for snakeyaml (SUSE-SU-2022:3397-1)
2022-09-27 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:3397-1)
2022-09-27 00:00:00
suse
suse
Security update for snakeyaml (important)
2022-09-26 00:00:00
rocky
rocky
Satellite 6.13 Release
2023-05-05 15:39:58
oracle
oracle
Oracle Critical Patch Update Advisory - January 2023
2023-01-17 00:00:00
Oracle Critical Patch Update Advisory - October 2022
2022-10-18 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
0.003
Percentile
69.6%
Related for NVD:CVE-2022-38752