The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade prometheus-jmx-exporter-openjdk11Upgrade prometheus-jmx-exporter | Oct 11, 2022 | Aug 30, 2022 |
| Amazon Linux Ami 2 | — | Upgrade snakeyamlUpgrade snakeyaml-javadoc | Mar 7, 2023 | Aug 30, 2022 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-version_gemUpgrade satellite-cliUpgrade rubygem-powerbarUpgrade prometheus-jmx-exporter-openjdk11Upgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debuginfoUpgrade python39-pulp_manifestUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-foreman_maintainUpgrade prometheus-jmx-exporter-openjdk8Upgrade rubygem-mime-typesUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-hashieUpgrade foreman-cliUpgrade rubygem-ffiUpgrade rubygem-oauthUpgrade rubygem-http-acceptUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foremanUpgrade prometheus-jmx-exporterUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-little-pluggerUpgrade rubygem-ffi-debuginfoUpgrade prometheus-jmx-exporter-openjdk17Upgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade satellite-cloneUpgrade rubygem-jwtUpgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-snaky_hashUpgrade satellite-maintainUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-amazing_printUpgrade rubygem-unicodeUpgrade rubygem-gssapiUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debugsource | Oct 20, 2022 | Aug 30, 2022 |
| Debian | — | Upgrade snakeyaml | Oct 4, 2022 | Aug 30, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Freebsd | — | Upgrade cassandra3 | Jan 13, 2023 | Jan 11, 2023 |
| Oracle_linux | — | Upgrade prometheus-jmx-exporterUpgrade prometheus-jmx-exporter-openjdk11 | Oct 7, 2022 | Aug 30, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 30, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Aug 30, 2022 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Feb 9, 2023 | Aug 30, 2022 |
| Redhat_linux | — | Upgrade prometheus-jmx-exporter-openjdk8Upgrade prometheus-jmx-exporter-openjdk11Upgrade prometheus-jmx-exporter-openjdk17Upgrade prometheus-jmx-exporterNo solution exists | Oct 20, 2022 | Aug 30, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfo | Mar 12, 2024 | Aug 30, 2022 |
| Suse | — | Upgrade snakeyamlUpgrade snakeyaml-javadoc | Oct 26, 2022 | Aug 30, 2022 |
| Ubuntu | — | Upgrade libyaml-snake-javaUpgrade libyaml-snake-java (Ubuntu Pro) | Mar 22, 2023 | Aug 30, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub