Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-unf_ext-debugsourceUpgrade rubygem-netrcUpgrade rubygem-unf_extUpgrade rubygem-mime-types-dataUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade foreman-cliUpgrade rubygem-foreman_maintainUpgrade rubygem-domain_nameUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-unicode-display_widthUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hashieUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-ffi-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-gssapiUpgrade rubygem-amazing_printUpgrade rubygem-localeUpgrade rubygem-little-pluggerUpgrade rubygem-fast_gettextUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debuginfoUpgrade rubygem-http-acceptUpgrade rubygem-jwtUpgrade rubygem-oauth-ttyUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-unicodeUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_google | May 4, 2023 | Sep 5, 2022 |
| Debian | — | Upgrade snakeyaml | Oct 4, 2022 | Sep 5, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Gentoo Linux | — | Upgrade dev-java/snakeyaml. | May 23, 2023 | Sep 5, 2022 |
| Redhat_linux | — | Upgrade satellite-maintainUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-http-acceptUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-ffiNo solution existsUpgrade rubygem-snaky_hashUpgrade rubygem-loggingUpgrade rubygem-ffi-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-http-cookieUpgrade rubygem-gssapiUpgrade rubygem-hammer_cliUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-ffi-debuginfoUpgrade rubygem-highlineUpgrade rubygem-amazing_printUpgrade python39-pulp_manifestUpgrade rubygem-oauthUpgrade rubygem-clampUpgrade rubygem-unicodeUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade foreman-cliUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_extUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-little-pluggerUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-foreman_maintainUpgrade rubygem-domain_nameUpgrade rubygem-hashieUpgrade rubygem-localeUpgrade rubygem-jwt | May 4, 2023 | Sep 5, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Sep 5, 2022 |
| Suse | — | Upgrade snakeyaml-javadocUpgrade snakeyaml | Oct 26, 2022 | Sep 5, 2022 |
| Ubuntu | — | Upgrade libyaml-snake-javaUpgrade libyaml-snake-java (Ubuntu Pro) | Mar 22, 2023 | Sep 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub