Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade snakeyamlUpgrade snakeyaml-javadoc | Jan 10, 2024 | Sep 5, 2022 |
| Centos_linux | — | Upgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-oauthUpgrade rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade rubygem-hashieUpgrade rubygem-foreman_maintainUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-version_gemUpgrade rubygem-domain_nameUpgrade rubygem-netrcUpgrade rubygem-clampUpgrade satellite-maintainUpgrade rubygem-unfUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-ffi-debuginfoUpgrade rubygem-http-acceptUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade satellite-cloneUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-little-pluggerUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-gssapiUpgrade rubygem-fast_gettextUpgrade rubygem-snaky_hashUpgrade rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-amazing_print | May 4, 2023 | Sep 5, 2022 |
| Debian | — | Upgrade snakeyaml | Oct 4, 2022 | Sep 5, 2022 |
| Gentoo Linux | — | Upgrade dev-java/snakeyaml. | May 23, 2023 | Sep 5, 2022 |
| Redhat_linux | — | Upgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffiUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-http-acceptUpgrade satellite-cliUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_azure_rmNo solution existsUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_openscapUpgrade python39-pulp_manifestUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-oauth-ttyUpgrade rubygem-loggingUpgrade rubygem-powerbarUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicodeUpgrade rubygem-domain_nameUpgrade rubygem-jwtUpgrade rubygem-rest-clientUpgrade rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-version_gemUpgrade foreman-cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-clampUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-localeUpgrade rubygem-snaky_hashUpgrade rubygem-hashieUpgrade rubygem-unfUpgrade rubygem-gssapiUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-fast_gettextUpgrade rubygem-highline | May 4, 2023 | Sep 5, 2022 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfo | Mar 12, 2024 | Sep 5, 2022 |
| Suse | — | Upgrade snakeyaml-javadocUpgrade snakeyaml | Oct 26, 2022 | Sep 5, 2022 |
| Ubuntu | — | Upgrade libyaml-snake-java (Ubuntu Pro)Upgrade libyaml-snake-java | Mar 22, 2023 | Sep 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub