GitHub Advisoryadvisory · Maven

GHSA-w37g-rhq8-7m4j Snakeyaml vulnerable to Stack overflow leading to denial of service

MEDIUM Published 2022-11-11 Modified 2024-06-21 Official page ↗
Aliases
CVE-2022-41854
Ecosystem
Maven
Packages
org.yaml:snakeyaml
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-121, CWE-787
Reviewed
2022-11-21

Affected packages

• Maven org.yaml:snakeyaml: < 1.32 → fixed in 1.32

Description

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.

Related

Alias · CVE (1)

  • CVE-2022-41854 Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). vulnerability

Weakness · CWE (2)

  • CWE-121 Stack-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness

References