CVE-2022-41854

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-41854
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.

5.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355 Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/
https://security.netapp.com/advisory/ntap-20240315-0009/
https://security.netapp.com/advisory/ntap-20240621-0006/
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355 Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/
https://security.netapp.com/advisory/ntap-20240315-0009/
https://security.netapp.com/advisory/ntap-20240621-0006/
Configurations

Configuration 1 (hide)

cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
History

21 Nov 2024, 07:23

Type Values Removed Values Added
References () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355 - Exploit, Issue Tracking, Third Party Advisory () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355 - Exploit, Issue Tracking, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/ -
References () https://security.netapp.com/advisory/ntap-20240315-0009/ - () https://security.netapp.com/advisory/ntap-20240315-0009/ -
References () https://security.netapp.com/advisory/ntap-20240621-0006/ - () https://security.netapp.com/advisory/ntap-20240621-0006/ -
CVSS v2 : unknown
v3 : 6.5 		v2 : unknown
v3 : 5.8

21 Jun 2024, 19:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240621-0006/ -

15 Mar 2024, 11:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240315-0009/ -

06 Jul 2023, 04:15

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE/ -
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/ - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/ - Mailing List, Third Party Advisory

21 Dec 2022, 04:15

Type Values Removed Values Added
CWE CWE-787
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/ -
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/ -
References (CONFIRM) https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355 - (CONFIRM) https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355 - Exploit, Issue Tracking, Third Party Advisory

11 Nov 2022, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-11-11 13:15

Updated : 2024-11-21 07:23

NVD link : CVE-2022-41854

Mitre link : CVE-2022-41854

CVE.ORG link : CVE-2022-41854

JSON object : View

Products Affected

snakeyaml_project

  • snakeyaml

fedoraproject

  • fedora
CWE
CWE-121

Stack-based Buffer Overflow

CWE-787

Out-of-bounds Write