Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-38751

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Published

2022-09-05T10:15:09.793

Last Modified

2024-11-21T07:17:01.357

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-121
Type: Primary
CWE-787

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	snakeyaml_project	snakeyaml	< 1.31	Yes
Operating System	debian	debian_linux	10.0	Yes

References

https://bitbucket.org/snakeyaml/snakeyaml/issues/530/stackoverflow-oss-fuzz-47039 Third Party Advisory ([email protected])
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47039 Third Party Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html Mailing List, Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/202305-28 ([email protected])
https://security.netapp.com/advisory/ntap-20240315-0010/ ([email protected])
https://bitbucket.org/snakeyaml/snakeyaml/issues/530/stackoverflow-oss-fuzz-47039 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47039 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202305-28 (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20240315-0010/ (af854a3a-2127-422b-91ae-364da2661108)