snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-38751 · ADVISORY
• bitbucket.org/snakeyaml/snakeyaml · PACKAGE
• bitbucket.org/snakeyaml/snakeyaml/issues/530/stackoverflow-oss-fuzz-47039 · WEB
• bitbucket.org/snakeyaml/snakeyaml/src/master/src/test/java/org/yaml/snakeyaml/issues/issue530/Fuzzy47039Test.java · WEB
• bugs.chromium.org/p/oss-fuzz/issues/detail · WEB
• lists.debian.org/debian-lts-announce/2022/10/msg00001.html · WEB
• security.gentoo.org/glsa/202305-28 · WEB
• security.netapp.com/advisory/ntap-20240315-0010 · WEB
• security.netapp.com/advisory/ntap-20240315-0010

Mais vulnerabilidades de org.yaml:snakeyaml

• CVE-2022-1471CRÍTICO 9.8SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provide…
• CVE-2022-41854MÉDIO 6.5Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user s…
• CVE-2022-38752MÉDIO 6.5Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplie…
• CVE-2022-38750MÉDIO 5.5Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplie…
• CVE-2022-38749MÉDIO 6.5Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplie…