SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade prometheus-jmx-exporterUpgrade prometheus-jmx-exporter-openjdk17Upgrade prometheus-jmx-exporter-openjdk8Upgrade prometheus-jmx-exporter-openjdk11 | Dec 19, 2022 | Dec 1, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Dec 6, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Apr 21, 2026 | Apr 21, 2026 |
| Centos_linux | — | Upgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_adminUpgrade prometheus-jmx-exporter-openjdk11Upgrade rubygem-hammer_cli_foreman_googleUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade prometheus-jmx-exporterUpgrade rubygem-hashieUpgrade rubygem-http-cookieUpgrade satellite-cliUpgrade prometheus-jmx-exporter-openjdk8Upgrade python39-pulp_manifestUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-localeUpgrade rubygem-mime-typesUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unf_ext-debuginfoUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_extUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-multi_jsonUpgrade rubygem-netrcUpgrade rubygem-oauth-ttyUpgrade satellite-maintainUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unfUpgrade rubygem-rest-clientUpgrade rubygem-loggingUpgrade rubygem-unicode-debugsourceUpgrade rubygem-clampUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_templatesUpgrade prometheus-jmx-exporter-openjdk17Upgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-unicodeUpgrade rubygem-oauth | Dec 16, 2022 | Dec 1, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Dec 1, 2022 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Dell Powerstore Dsa2025182 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Apr 17, 2025 |
| Oracle_linux | — | Upgrade prometheus-jmx-exporter-openjdk17Upgrade prometheus-jmx-exporter-openjdk8Upgrade prometheus-jmx-exporterUpgrade prometheus-jmx-exporter-openjdk11 | Dec 16, 2022 | Oct 13, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 13, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 1, 2022 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Feb 16, 2023 | Oct 13, 2022 |
| Redhat_linux | — | Upgrade prometheus-jmx-exporter-openjdk17Upgrade prometheus-jmx-exporterNo solution existsUpgrade prometheus-jmx-exporter-openjdk11Upgrade prometheus-jmx-exporter-openjdk8 | Dec 16, 2022 | Dec 1, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Dec 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub