CVE-2022-38749mediumCWE-121

CVE-2022-38749: medium-severity vulnerability in SnakeYAML

DoS in SnakeYAML

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 2.1%
exploitation probability
2.1%top 19% of all CVEs
observed exploitation
nono source reports it
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
snakeyaml · SnakeYAML
Related CVEs — SnakeYAML

In the same product, most dangerous first.

CVE-2022-38752MEDIUMDoS in SnakeYAMLEPSS 2.5%CVE-2022-38751MEDIUMDoS in SnakeYAMLEPSS 1.9%CVE-2022-38750MEDIUMDoS in SnakeYAMLEPSS 1.3%
References
https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-openhttps://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47024https://lists.debian.org/debian-lts-announce/2022/10/msg00001.htmlhttps://security.gentoo.org/glsa/202305-28https://security.netapp.com/advisory/ntap-20240315-0010/