apache-commons-configuration:YAMLConfigurationReadFuzzer: Security exception in org.yaml.snakeyaml.composer.Composer.composeMappingNode

Detailed Report: https://oss-fuzz.com/testcase?key=5227066127155200 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationReadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...

snakeyaml:YamlFuzzer: Security exception in java.base/java.util.AbstractSet.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=5167495132086272 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.AbstractSet.hashCode...

Security Bulletin: IBM Sterling B2B Integrator is vulnerable to denial of service due to SnakeYAML (CVE-2017-18640)

Summary MyFG 2.0 of IBM Sterling B2B Integrator uses SnakeYAML. There is a denial of service vulnerability in SnakeYAML which has been addressed. Vulnerability Details CVEID:CVE-2017-18640 DESCRIPTION: SnakeYAML is vulnerable to a denial of service, caused by an entity expansion in Alias feature...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject

Detailed Report: https://oss-fuzz.com/testcase?key=6739209968287744 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

Kaitai Struct: compiler vulnerable to denial-of-service (DoS)

Overview Kaitai Struct: compiler provided by Kaitai team contains SnakeYAML library version 1.25, which is used in parsing .ksy files. SnakeYAML version 1.25 expands recursive aliases unlimitedly CWE-674, hence Katai Struct: compiler is vulnerable to a denial-of-service DoS attack by Billion Laug...

JVN#42883072: Kaitai Struct: compiler vulnerable to denial-of-service (DoS)

Kaitai Struct: compiler provided by Kaitai team contains SnakeYAML library version 1.25, which is used in parsing .ksy files. SnakeYAML version 1.25 expands recursive aliases unlimitedly CWE-674, hence Katai Struct: compiler is vulnerable to a denial-of-service DoS attack by Billion Laughs Attack...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeMappingChildren

Detailed Report: https://oss-fuzz.com/testcase?key=5790977205338112 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.constructor.SafeConstructor.constructMapping2ndStep

Detailed Report: https://oss-fuzz.com/testcase?key=5953451405737984 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.constructor.SafeConstructor$ConstructYamlMap.construct

Detailed Report: https://oss-fuzz.com/testcase?key=5765799788281856 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities

Summary Security vulnerabilities have been addressed in IBM Cognos Analytics 11.1.7 FP5. These vulnerabilities have also been previously addressed in IBM Cognos Analytics 11.2.2. The following 3rd party components are used by IBM Cognos Analytics: Apache Axis is a Java based Web Services engine f...

apache-commons-configuration:YAMLConfigurationReadFuzzer: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeKeyNode

Detailed Report: https://oss-fuzz.com/testcase?key=4727913183838208 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationReadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

Deserialization of Untrusted Data in Apache Brooklyn

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...

GHSA-9CQH-5X6G-WGM9 Deserialization of Untrusted Data in Apache Brooklyn

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...

Develar SnakeYAML Entity Expansion (CVE-2017-18640)

An entity expansion vulnerability exists in Develar SnakeYAML. Successful exploitation of this vulnerability would allow remote attackers to cause the affected system to crash or become unresponsive...

Denial of Service (DoS)

Overview org.yaml:snakeyaml is a YAML 1.1 parser and emitter for Java. Affected versions of this package are vulnerable to Denial of Service DoS due to missing nested depth limitation for collections. NOTE: This vulnerability has also been identified as: CVE-2022-38749 Details Denial of Service D...

snakeyaml:YamlFuzzer: Uncaught exception in java.base/java.util.ArrayList.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=4919139099082752 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.util.ArrayList.hashCode...

snakeyaml:YamlFuzzer: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match

Detailed Report: https://oss-fuzz.com/testcase?key=5110034188599296 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.util.regex.Pattern$Ques.match...

snakeyaml:YamlFuzzer: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject

Detailed Report: https://oss-fuzz.com/testcase?key=5427149240139776 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

snakeyaml:YamlFuzzer: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode

Detailed Report: https://oss-fuzz.com/testcase?key=4626423186325504 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

PT-2022-6078

Name of the Vulnerable Software and Affected Versions SnakeYaml versions prior to 2.0 Bitbucket Data Center versions 7.17.x through 8.8.6 Bitbucket Server versions 7.17.x through 8.8.6 Confluence Data Center versions 6.13.x through 8.3.0 Confluence Server versions 6.13.x through 8.3.0 Description...