CVE-2022-25857

NameCVE-2022-25857
DescriptionThe package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3132-1
Debian Bugs1019218

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
snakeyaml (PTS)bullseye1.28-1+deb11u2fixed
bookworm1.33-2fixed
sid, trixie2.0+ds+really1.33-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
snakeyamlsourcebuster1.23-1+deb10u1DLA-3132-1
snakeyamlsourcebullseye1.28-1+deb11u1
snakeyamlsource(unstable)1.31-11019218

Notes

https://bitbucket.org/snakeyaml/snakeyaml/issues/525
https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174
https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360
Search for package or bug name: Reporting problems