Deserialization of Untrusted Data in JYaml

CRITICO 9.8CVE-2020-8441 · GHSA-4qhr-q7wf-94xp · Published 19/02/2020 · updated 17/06/2026

In breve

CVE-2020-8441 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.jyaml:jyaml, jyaml (jyaml project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 5.0%, superiore al 92.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
org.jyaml:jyaml Maven	`≤ 1.3`	No fix yet
jyaml jyaml_project	`≤ 1.3`	No fix yet

Description

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.

NVD description

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.

References

nvd.nist.gov/vuln/detail/CVE-2020-8441 · ADVISORY
gist.github.com/j0lt-github/f5141abcacae63d434ecae211422153a · WEB
mbechler/marshalsec · WEB
mbechler/marshalsec · WEB
security.netapp.com/advisory/ntap-20200313-0001 · WEB
sourceforge.net/p/jyaml/bugs · WEB
security.netapp.com/advisory/ntap-20200313-0001
sourceforge.net/p/jyaml/bugs · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free