CVE-2022-25857

NameCVE-2022-25857
DescriptionThe package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3132-1
Debian Bugs1019218

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
snakeyaml (PTS)buster1.23-1vulnerable
buster (security)1.23-1+deb10u1fixed
bullseye1.28-1vulnerable
bookworm1.29-1vulnerable
sid1.33-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
snakeyamlsourcebuster1.23-1+deb10u1DLA-3132-1
snakeyamlsource(unstable)1.31-11019218

Notes

[bullseye] - snakeyaml <no-dsa> (Minor issue)
https://bitbucket.org/snakeyaml/snakeyaml/issues/525
https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174
https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360

Search for package or bug name: Reporting problems