EUVD-2019-2175

Malware in sbrugna...

Denial Of Service (DoS)

snakeyaml is vulnerable to denial of service. The vulnerability exists in the Composer function of Composer.java as it does not properly restrict the nested depth limitation for collections which allows an attacker to crash the application through the stack overflow by providing malicious yaml...

Denial Of Service (DoS)

snakeyaml is vulnerable to Denial Of Service DoS. The vulnerability exists in the Composer function of Composer.java as it does not properly restrict the nested depth limitation for collections, allowing an attacker to crash the application through the stack overflow by providing malicious yaml...

Arbitrary Code Execution

kubernetes java client is vulnerable to arbitrary code execution. An attacker is able to execute arbtirary code on the host OS by loading malicious YAML files...

Design/Logic Flaw

A flaw was found in the yaml.load function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files...

CVE-2019-10135

A flaw was found in the yaml.load function in the osbs-client prior to version 0.56.1. Insecure use of the yaml.load function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files...

Denial Of Service (DoS)

yaml-cpp aka LibYaml is vulnerable to denial of service DoS attacks. The attacks are possible because the SingleDocParser::HandleNode function does not handle YAML files properly, allowing the attackers to trigger stack consumption and application crash using malicious YAML files...