GitHub Advisoryadvisory · Maven

GHSA-9w3m-gqgf-c4p9 snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write

MEDIUM Published 2022-09-06 Modified 2024-03-15 Official page ↗
Aliases
CVE-2022-38752
Ecosystem
Maven
Packages
org.yaml:snakeyaml
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-121, CWE-787
Reviewed
2022-09-13

Affected packages

• Maven org.yaml:snakeyaml: < 1.32 → fixed in 1.32

Description

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DoS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

Related

Alias · CVE (1)

  • CVE-2022-38752 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). vulnerability

Weakness · CWE (2)

  • CWE-121 Stack-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness

References