critique
CVE-2022-1471
SnakeYaml: Constructor Deserialization Remote Code Execution
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée), Red Hat (élevée), AlmaLinux (élevée), Oracle (élevée), Rocky Linux (élevée).
Description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 et 1 autres | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0, cassandra-4.1, cassandra-5.0 et 13 autres | 0 et 6 autres |
| debian 11 | snakeyaml | pas de correctif indiqué |
| debian 12 | snakeyaml | pas de correctif indiqué |
| debian 13 | snakeyaml | pas de correctif indiqué |
| debian 14 | snakeyaml | pas de correctif indiqué |
| echo | snakeyaml | pas de correctif indiqué |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid, apache-druid-fips, cdc-apache-cassandra-5.0 et 3 autres | 37.0.0-r1 et 3 autres |
| Oracle Linux 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 et 1 autres | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | pas de correctif indiqué |
Afficher les 60 entrées de 19 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0 | 0 |
| chainguard | cassandra-4.1 | 0 |
| chainguard | cassandra-5.0 | 0 |
| chainguard | cassandra-fips-4.0 | 0 |
| chainguard | cassandra-fips-4.1 | 0 |
| chainguard | cassandra-fips-5.0 | 0 |
| chainguard | cassandra-reaper | 4.0.1-r1 |
| chainguard | druid | 0 |
| chainguard | elasticsearch-7 | 0 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0.1.89-r0 |
| chainguard | management-api-for-apache-cassandra-4.1 | 0.1.109-r0 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| chainguard | metric-collector-for-apache-cassandra-4.0 | 0.3.6-r2 |
| chainguard | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
| chainguard | s3proxy | 3.3.0-r2 |
| chainguard | s3proxy-fips | 3.3.0-r2 |
| debian 11 | snakeyaml | pas de correctif indiqué |
| debian 12 | snakeyaml | pas de correctif indiqué |
| debian 13 | snakeyaml | pas de correctif indiqué |
| debian 14 | snakeyaml | pas de correctif indiqué |
| echo | snakeyaml | pas de correctif indiqué |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid | 37.0.0-r1 |
| minimos | apache-druid-fips | 37.0.0-r1 |
| minimos | cdc-apache-cassandra-5.0 | 2.3.9-r0 |
| minimos | cdc-apache-cassandra-fips-5.0 | 2.3.9-r0 |
| minimos | stargate | 2.0.51-r3 |
| minimos | stargate-fips | 2.0.51-r1 |
| Oracle Linux 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | pas de correctif indiqué |
| rapidfort debian 12 | snakeyaml | pas de correctif indiqué |
| rapidfort debian 13 | snakeyaml | pas de correctif indiqué |
| Red Hat | candlepin | pas de correctif indiqué |
| Red Hat | candlepin-selinux | pas de correctif indiqué |
| Red Hat | jenkins-2-plugins | pas de correctif indiqué |
| Red Hat | puppetserver | pas de correctif indiqué |
| Red Hat | snakeyaml | pas de correctif indiqué |
| Red Hat | snakeyaml-javadoc | pas de correctif indiqué |
| rocky 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| seal Red Hat 7 | python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 7 | seal-python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 8 | libsolv | 0.7.20-6.el8+sp999 |
| seal Red Hat 8 | seal-libsolv | 0.7.20-6.el8+sp999 |
| wolfi | cassandra-4.1 | 0 |
| wolfi | cassandra-5.0 | 0 |
| wolfi | cassandra-reaper | 4.0.1-r1 |
| wolfi | druid | 0 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| wolfi | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
Références
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://access.redhat.com/errata/RHSA-2022:9058
- https://access.redhat.com/security/cve/CVE-2022-1471
- https://advisory.echohq.com/cve/CVE-2022-1471
- https://bitbucket.org/snakeyaml/snakeyaml
- https://bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758
- https://bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4
Les 33 références
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64876314
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE-2022-1471
- https://bugzilla.redhat.com/2150009
- https://bugzilla.redhat.com/show_bug.cgi?id=2150009
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1471
- https://errata.almalinux.org/8/ALSA-2022-9058.html
- https://errata.rockylinux.org/RLSA-2022:9058
- https://github.com/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/mbechler/marshalsec
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://linux.oracle.com/cve/CVE-2022-1471.html
- https://linux.oracle.com/errata/ELSA-2022-9058-1.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-1471
- https://security.netapp.com/advisory/ntap-20230818-0015
- https://security.netapp.com/advisory/ntap-20230818-0015/
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471
- https://www.cve.org/CVERecord?id=CVE-2022-1471
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true