UBUNTU-CVE-2022-25857

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...

CVE-2022-25857

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...

CVE-2022-25857: Improper Restriction of Recursive Entity References in DTDs

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...

SnakeYAML 资源管理错误漏洞

SnakeYAML is a Java-based YAML parser. A security vulnerability exists in SnakeYAML 1.31 and earlier versions, which stems from a denial of service DoS issue due to the lack of a nesting depth limit for collections...

PT-2022-6923

Name of the Vulnerable Software and Affected Versions org.yaml:snakeyaml versions 0 through 1.30 Description The issue is related to a Denial of Service DoS vulnerability due to missing nested depth limitation for collections in the SnakeYAML library, which is used for serialization and...

apache-commons-configuration:YAMLConfigurationReadFuzzer: Security exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject

Detailed Report: https://oss-fuzz.com/testcase?key=5983542454124544 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationReadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...

apache-commons-configuration:YAMLConfigurationReadFuzzer: Security exception in org.yaml.snakeyaml.composer.Composer.composeMappingNode

Detailed Report: https://oss-fuzz.com/testcase?key=5227066127155200 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationReadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...

snakeyaml:YamlFuzzer: Security exception in java.base/java.util.AbstractSet.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=5167495132086272 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.AbstractSet.hashCode...

Security Bulletin: IBM Sterling B2B Integrator is vulnerable to denial of service due to SnakeYAML (CVE-2017-18640)

Summary MyFG 2.0 of IBM Sterling B2B Integrator uses SnakeYAML. There is a denial of service vulnerability in SnakeYAML which has been addressed. Vulnerability Details CVEID:CVE-2017-18640 DESCRIPTION: SnakeYAML is vulnerable to a denial of service, caused by an entity expansion in Alias feature...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject

Detailed Report: https://oss-fuzz.com/testcase?key=6739209968287744 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

Kaitai Struct: compiler vulnerable to denial-of-service (DoS)

Overview Kaitai Struct: compiler provided by Kaitai team contains SnakeYAML library version 1.25, which is used in parsing .ksy files. SnakeYAML version 1.25 expands recursive aliases unlimitedly CWE-674, hence Katai Struct: compiler is vulnerable to a denial-of-service DoS attack by Billion Laug...

JVN#42883072: Kaitai Struct: compiler vulnerable to denial-of-service (DoS)

Kaitai Struct: compiler provided by Kaitai team contains SnakeYAML library version 1.25, which is used in parsing .ksy files. SnakeYAML version 1.25 expands recursive aliases unlimitedly CWE-674, hence Katai Struct: compiler is vulnerable to a denial-of-service DoS attack by Billion Laughs Attack...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeMappingChildren

Detailed Report: https://oss-fuzz.com/testcase?key=5790977205338112 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.constructor.SafeConstructor.constructMapping2ndStep

Detailed Report: https://oss-fuzz.com/testcase?key=5953451405737984 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.constructor.SafeConstructor$ConstructYamlMap.construct

Detailed Report: https://oss-fuzz.com/testcase?key=5765799788281856 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities

Summary Security vulnerabilities have been addressed in IBM Cognos Analytics 11.1.7 FP5. These vulnerabilities have also been previously addressed in IBM Cognos Analytics 11.2.2. The following 3rd party components are used by IBM Cognos Analytics: Apache Axis is a Java based Web Services engine f...

apache-commons-configuration:YAMLConfigurationReadFuzzer: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeKeyNode

Detailed Report: https://oss-fuzz.com/testcase?key=4727913183838208 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationReadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

GHSA-9CQH-5X6G-WGM9 Deserialization of Untrusted Data in Apache Brooklyn

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...

Deserialization of Untrusted Data in Apache Brooklyn

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...

Develar SnakeYAML Entity Expansion (CVE-2017-18640)

An entity expansion vulnerability exists in Develar SnakeYAML. Successful exploitation of this vulnerability would allow remote attackers to cause the affected system to crash or become unresponsive...