CVE-2022-25857

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-25857

Severity

7.5

High

CVSS V3

Eliminate CVEs with Chainguard hardened images

Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.

Start for free

Description

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-25857
https://github.com/advisories/GHSA-3mc7-4q67-w48m
https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174
https://bitbucket.org/snakeyaml/snakeyaml/issues/525
https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html
https://security.netapp.com/advisory/ntap-20240315-0010/
https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

The trusted source for open source

Talk to an expert

Privacy

Terms

CVE-2022-25857

Severity

Description

References

Affected packages

The trusted source for open source

Product

Solutions

Customers

Resources

Company