CVE-2022-38752 - OpenCVE

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Snakeyaml Project	Snakeyaml

Configuration 1 [-]

cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*

References

Link	Resource
https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081	Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081	Permissions Required
https://security.gentoo.org/glsa/202305-28
https://security.netapp.com/advisory/ntap-20240315-0009/

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: Google

Published: 2022-09-05T00:00:00

Updated: 2024-03-15T11:06:17.930113

Reserved: 2022-08-25T00:00:00

Link: CVE-2022-38752

JSON object: View

NVD Information

Status : Modified

Published: 2022-09-05T10:15:09.847

Modified: 2024-03-15T11:15:08.207

Link: CVE-2022-38752

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*", "matchCriteriaId": "F180BD10-FFC7-4197-9D18-59920B6D9955", "versionEndExcluding": "1.32", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow."}, {"lang": "es", "value": "El uso de snakeYAML para analizar archivos YAML no confiables puede ser vulnerable a ataques de Denegaci\u00f3n de Servicio (DOS). Si el analizador es ejecutado en la entrada suministrada por el usuario, un atacante puede suministrar contenido que hace que el analizador sea bloqueado por desbordamiento de pila"}], "id": "CVE-2022-38752", "lastModified": "2024-03-15T11:15:08.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve-coordination@google.com", "type": "Secondary"}]}, "published": "2022-09-05T10:15:09.847", "references": [{"source": "cve-coordination@google.com", "tags": ["Third Party Advisory"], "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081"}, {"source": "cve-coordination@google.com", "tags": ["Permissions Required"], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081"}, {"source": "cve-coordination@google.com", "url": "https://security.gentoo.org/glsa/202305-28"}, {"source": "cve-coordination@google.com", "url": "https://security.netapp.com/advisory/ntap-20240315-0009/"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-121"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}