Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-38749

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Published

2022-09-05T10:15:09.673

Last Modified

2024-11-21T07:17:01.060

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-121
Type: Primary
CWE-787

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	snakeyaml_project	snakeyaml	< 1.31	Yes
Operating System	debian	debian_linux	10.0	Yes

References

https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open Third Party Advisory ([email protected])
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47024 Third Party Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html Mailing List, Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/202305-28 ([email protected])
https://security.netapp.com/advisory/ntap-20240315-0010/ ([email protected])
https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47024 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202305-28 (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20240315-0010/ (af854a3a-2127-422b-91ae-364da2661108)