PT-2022-6915 · Snakeyaml+5 · Snakeyaml+5

Published 2022-09-05 · Updated 2024-03-15 · CVE-2022-38749

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions snakeYAML (affected versions not specified)

Description The issue is related to a Denial of Service (DOS) attack that can occur when using snakeYAML to parse untrusted YAML files. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash due to a stack overflow. This can be exploited by a remote attacker to cause a service disruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

BDU:2023-05608

CVE-2022-38749

DLA-3132-1

GHSA-C4R9-R8FH-9VJ2

OESA-2023-1162

OESA-2023-1163

OESA-2023-1164

OESA-2023-1165

OPENSUSE-SU-2022_3397-1

OPENSUSE-SU-2024:12308-1

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

RHSA-2023:2097

RLSA-2023:2097

SUSE-SU-2022:3397-1

SUSE-SU-2022:3560-1

USN-5944-1

Affected Products

Astra Linux

Linuxmint

Rocky Linux

Suse

Ubuntu

Snakeyaml

References · 58

• https://ubuntu.com/security/CVE-2022-25857 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38751 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-38749 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1164 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-38750 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-38749 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-38751 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25857 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-38749 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3397-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38750 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38749 · Security Note
• https://osv.dev/vulnerability/GHSA-c4r9-r8fh-9vj2 · Vendor Advisory