CVE-2022-38750

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Configurations

Configuration 1 (hide)

cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

History

15 Mar 2024, 11:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240315-0010/ -

21 May 2023, 22:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202305-28 -

06 Oct 2022, 12:51

Type Values Removed Values Added
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html - Mailing List, Third Party Advisory
First Time Debian debian Linux
Debian
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

03 Oct 2022, 00:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html -

09 Sep 2022, 14:21

Type Values Removed Values Added
First Time Snakeyaml Project
Snakeyaml Project snakeyaml
References (MISC) https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027 - (MISC) https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027 - Exploit, Issue Tracking, Third Party Advisory
References (MISC) https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027 - (MISC) https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027 - Exploit, Issue Tracking, Mailing List, Third Party Advisory
CWE CWE-787
CPE cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.5

05 Sep 2022, 10:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-09-05 10:15

Updated : 2024-03-15 11:15


NVD link : CVE-2022-38750

Mitre link : CVE-2022-38750

CVE.ORG link : CVE-2022-38750


JSON object : View

Products Affected

snakeyaml_project

  • snakeyaml

debian

  • debian_linux
CWE
CWE-787

Out-of-bounds Write

CWE-121

Stack-based Buffer Overflow