kritisch
CVE-2022-1471
SnakeYaml: Constructor Deserialization Remote Code Execution
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (hoch), AlmaLinux (hoch), Oracle (hoch), Rocky Linux (hoch).
Beschreibung
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 und 1 weitere | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0, cassandra-4.1, cassandra-5.0 und 13 weitere | 0 und 6 weitere |
| debian 11 | snakeyaml | kein Fix angegeben |
| debian 12 | snakeyaml | kein Fix angegeben |
| debian 13 | snakeyaml | kein Fix angegeben |
| debian 14 | snakeyaml | kein Fix angegeben |
| echo | snakeyaml | kein Fix angegeben |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid, apache-druid-fips, cdc-apache-cassandra-5.0 und 3 weitere | 37.0.0-r1 und 3 weitere |
| Oracle Linux 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 und 1 weitere | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | kein Fix angegeben |
Alle 60 Einträge aus 19 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0 | 0 |
| chainguard | cassandra-4.1 | 0 |
| chainguard | cassandra-5.0 | 0 |
| chainguard | cassandra-fips-4.0 | 0 |
| chainguard | cassandra-fips-4.1 | 0 |
| chainguard | cassandra-fips-5.0 | 0 |
| chainguard | cassandra-reaper | 4.0.1-r1 |
| chainguard | druid | 0 |
| chainguard | elasticsearch-7 | 0 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0.1.89-r0 |
| chainguard | management-api-for-apache-cassandra-4.1 | 0.1.109-r0 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| chainguard | metric-collector-for-apache-cassandra-4.0 | 0.3.6-r2 |
| chainguard | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
| chainguard | s3proxy | 3.3.0-r2 |
| chainguard | s3proxy-fips | 3.3.0-r2 |
| debian 11 | snakeyaml | kein Fix angegeben |
| debian 12 | snakeyaml | kein Fix angegeben |
| debian 13 | snakeyaml | kein Fix angegeben |
| debian 14 | snakeyaml | kein Fix angegeben |
| echo | snakeyaml | kein Fix angegeben |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid | 37.0.0-r1 |
| minimos | apache-druid-fips | 37.0.0-r1 |
| minimos | cdc-apache-cassandra-5.0 | 2.3.9-r0 |
| minimos | cdc-apache-cassandra-fips-5.0 | 2.3.9-r0 |
| minimos | stargate | 2.0.51-r3 |
| minimos | stargate-fips | 2.0.51-r1 |
| Oracle Linux 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | kein Fix angegeben |
| rapidfort debian 12 | snakeyaml | kein Fix angegeben |
| rapidfort debian 13 | snakeyaml | kein Fix angegeben |
| Red Hat | candlepin | kein Fix angegeben |
| Red Hat | candlepin-selinux | kein Fix angegeben |
| Red Hat | jenkins-2-plugins | kein Fix angegeben |
| Red Hat | puppetserver | kein Fix angegeben |
| Red Hat | snakeyaml | kein Fix angegeben |
| Red Hat | snakeyaml-javadoc | kein Fix angegeben |
| rocky 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| seal Red Hat 7 | python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 7 | seal-python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 8 | libsolv | 0.7.20-6.el8+sp999 |
| seal Red Hat 8 | seal-libsolv | 0.7.20-6.el8+sp999 |
| wolfi | cassandra-4.1 | 0 |
| wolfi | cassandra-5.0 | 0 |
| wolfi | cassandra-reaper | 4.0.1-r1 |
| wolfi | druid | 0 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| wolfi | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
Referenzen
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://access.redhat.com/errata/RHSA-2022:9058
- https://access.redhat.com/security/cve/CVE-2022-1471
- https://advisory.echohq.com/cve/CVE-2022-1471
- https://bitbucket.org/snakeyaml/snakeyaml
- https://bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758
- https://bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4
Alle 33 Referenzen
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64876314
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE-2022-1471
- https://bugzilla.redhat.com/2150009
- https://bugzilla.redhat.com/show_bug.cgi?id=2150009
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1471
- https://errata.almalinux.org/8/ALSA-2022-9058.html
- https://errata.rockylinux.org/RLSA-2022:9058
- https://github.com/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/mbechler/marshalsec
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://linux.oracle.com/cve/CVE-2022-1471.html
- https://linux.oracle.com/errata/ELSA-2022-9058-1.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-1471
- https://security.netapp.com/advisory/ntap-20230818-0015
- https://security.netapp.com/advisory/ntap-20230818-0015/
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471
- https://www.cve.org/CVERecord?id=CVE-2022-1471
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true