GitHub Advisoryadvisory · Maven

GHSA-hhhw-99gj-p3c3 snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write

MEDIUM Published 2022-09-06 Modified 2024-03-15 Official page ↗
Aliases
CVE-2022-38750
Ecosystem
Maven
Packages
org.yaml:snakeyaml
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-121, CWE-787
Reviewed
2022-09-16

Affected packages

• Maven org.yaml:snakeyaml: < 1.31 → fixed in 1.31

Description

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Related

Alias · CVE (1)

  • CVE-2022-38750 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). vulnerability

Weakness · CWE (2)

  • CWE-121 Stack-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness

References