snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2022-38750 · ADVISORY
• bitbucket.org/snakeyaml/snakeyaml · PACKAGE
• bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027 · WEB
• bugs.chromium.org/p/oss-fuzz/issues/detail · WEB
• lists.debian.org/debian-lts-announce/2022/10/msg00001.html · WEB
• security.gentoo.org/glsa/202305-28 · WEB
• security.netapp.com/advisory/ntap-20240315-0010 · WEB
• security.netapp.com/advisory/ntap-20240315-0010

Lỗ hổng khác của org.yaml:snakeyaml

• CVE-2022-1471NGHIÊM TRỌNG 9.8SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provide…
• CVE-2022-41854TRUNG BÌNH 6.5Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user s…
• CVE-2022-38752TRUNG BÌNH 6.5Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplie…
• CVE-2022-38751TRUNG BÌNH 6.5Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplie…
• CVE-2022-38749TRUNG BÌNH 6.5Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplie…