Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-38750

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Published

2022-09-05T10:15:09.733

Last Modified

2024-11-21T07:17:01.207

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-121
Type: Primary
CWE-787

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	snakeyaml_project	snakeyaml	< 1.31	Yes
Operating System	debian	debian_linux	10.0	Yes

References

https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027 Exploit, Issue Tracking, Third Party Advisory ([email protected])
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027 Exploit, Issue Tracking, Mailing List, Third Party Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html Mailing List, Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/202305-28 ([email protected])
https://security.netapp.com/advisory/ntap-20240315-0010/ ([email protected])
https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027 Exploit, Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027 Exploit, Issue Tracking, Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202305-28 (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20240315-0010/ (af854a3a-2127-422b-91ae-364da2661108)