crítica
CVE-2022-1471
SnakeYaml: Constructor Deserialization Remote Code Execution
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (alta), AlmaLinux (alta), Oracle (alta), Rocky Linux (alta).
Descripción
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 y 1 más | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0, cassandra-4.1, cassandra-5.0 y 13 más | 0 y 6 más |
| debian 11 | snakeyaml | sin corrección indicada |
| debian 12 | snakeyaml | sin corrección indicada |
| debian 13 | snakeyaml | sin corrección indicada |
| debian 14 | snakeyaml | sin corrección indicada |
| echo | snakeyaml | sin corrección indicada |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid, apache-druid-fips, cdc-apache-cassandra-5.0 y 3 más | 37.0.0-r1 y 3 más |
| Oracle Linux 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 y 1 más | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | sin corrección indicada |
Mostrar las 60 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0 | 0 |
| chainguard | cassandra-4.1 | 0 |
| chainguard | cassandra-5.0 | 0 |
| chainguard | cassandra-fips-4.0 | 0 |
| chainguard | cassandra-fips-4.1 | 0 |
| chainguard | cassandra-fips-5.0 | 0 |
| chainguard | cassandra-reaper | 4.0.1-r1 |
| chainguard | druid | 0 |
| chainguard | elasticsearch-7 | 0 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0.1.89-r0 |
| chainguard | management-api-for-apache-cassandra-4.1 | 0.1.109-r0 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| chainguard | metric-collector-for-apache-cassandra-4.0 | 0.3.6-r2 |
| chainguard | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
| chainguard | s3proxy | 3.3.0-r2 |
| chainguard | s3proxy-fips | 3.3.0-r2 |
| debian 11 | snakeyaml | sin corrección indicada |
| debian 12 | snakeyaml | sin corrección indicada |
| debian 13 | snakeyaml | sin corrección indicada |
| debian 14 | snakeyaml | sin corrección indicada |
| echo | snakeyaml | sin corrección indicada |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid | 37.0.0-r1 |
| minimos | apache-druid-fips | 37.0.0-r1 |
| minimos | cdc-apache-cassandra-5.0 | 2.3.9-r0 |
| minimos | cdc-apache-cassandra-fips-5.0 | 2.3.9-r0 |
| minimos | stargate | 2.0.51-r3 |
| minimos | stargate-fips | 2.0.51-r1 |
| Oracle Linux 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | sin corrección indicada |
| rapidfort debian 12 | snakeyaml | sin corrección indicada |
| rapidfort debian 13 | snakeyaml | sin corrección indicada |
| Red Hat | candlepin | sin corrección indicada |
| Red Hat | candlepin-selinux | sin corrección indicada |
| Red Hat | jenkins-2-plugins | sin corrección indicada |
| Red Hat | puppetserver | sin corrección indicada |
| Red Hat | snakeyaml | sin corrección indicada |
| Red Hat | snakeyaml-javadoc | sin corrección indicada |
| rocky 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| seal Red Hat 7 | python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 7 | seal-python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 8 | libsolv | 0.7.20-6.el8+sp999 |
| seal Red Hat 8 | seal-libsolv | 0.7.20-6.el8+sp999 |
| wolfi | cassandra-4.1 | 0 |
| wolfi | cassandra-5.0 | 0 |
| wolfi | cassandra-reaper | 4.0.1-r1 |
| wolfi | druid | 0 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| wolfi | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
Referencias
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://access.redhat.com/errata/RHSA-2022:9058
- https://access.redhat.com/security/cve/CVE-2022-1471
- https://advisory.echohq.com/cve/CVE-2022-1471
- https://bitbucket.org/snakeyaml/snakeyaml
- https://bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758
- https://bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4
Las 33 referencias
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64876314
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE-2022-1471
- https://bugzilla.redhat.com/2150009
- https://bugzilla.redhat.com/show_bug.cgi?id=2150009
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1471
- https://errata.almalinux.org/8/ALSA-2022-9058.html
- https://errata.rockylinux.org/RLSA-2022:9058
- https://github.com/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/mbechler/marshalsec
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://linux.oracle.com/cve/CVE-2022-1471.html
- https://linux.oracle.com/errata/ELSA-2022-9058-1.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-1471
- https://security.netapp.com/advisory/ntap-20230818-0015
- https://security.netapp.com/advisory/ntap-20230818-0015/
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471
- https://www.cve.org/CVERecord?id=CVE-2022-1471
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true