kritik
CVE-2022-1471
SnakeYaml: Constructor Deserialization Remote Code Execution
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Red Hat (yüksek), AlmaLinux (yüksek), Oracle (yüksek), Rocky Linux (yüksek).
Açıklama
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 ve 1 tane daha | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0, cassandra-4.1, cassandra-5.0 ve 13 tane daha | 0 ve 6 tane daha |
| debian 11 | snakeyaml | düzeltme belirtilmemiş |
| debian 12 | snakeyaml | düzeltme belirtilmemiş |
| debian 13 | snakeyaml | düzeltme belirtilmemiş |
| debian 14 | snakeyaml | düzeltme belirtilmemiş |
| echo | snakeyaml | düzeltme belirtilmemiş |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid, apache-druid-fips, cdc-apache-cassandra-5.0 ve 3 tane daha | 37.0.0-r1 ve 3 tane daha |
| Oracle Linux 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 ve 1 tane daha | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | düzeltme belirtilmemiş |
19 kaynaktaki 60 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0 | 0 |
| chainguard | cassandra-4.1 | 0 |
| chainguard | cassandra-5.0 | 0 |
| chainguard | cassandra-fips-4.0 | 0 |
| chainguard | cassandra-fips-4.1 | 0 |
| chainguard | cassandra-fips-5.0 | 0 |
| chainguard | cassandra-reaper | 4.0.1-r1 |
| chainguard | druid | 0 |
| chainguard | elasticsearch-7 | 0 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0.1.89-r0 |
| chainguard | management-api-for-apache-cassandra-4.1 | 0.1.109-r0 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| chainguard | metric-collector-for-apache-cassandra-4.0 | 0.3.6-r2 |
| chainguard | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
| chainguard | s3proxy | 3.3.0-r2 |
| chainguard | s3proxy-fips | 3.3.0-r2 |
| debian 11 | snakeyaml | düzeltme belirtilmemiş |
| debian 12 | snakeyaml | düzeltme belirtilmemiş |
| debian 13 | snakeyaml | düzeltme belirtilmemiş |
| debian 14 | snakeyaml | düzeltme belirtilmemiş |
| echo | snakeyaml | düzeltme belirtilmemiş |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid | 37.0.0-r1 |
| minimos | apache-druid-fips | 37.0.0-r1 |
| minimos | cdc-apache-cassandra-5.0 | 2.3.9-r0 |
| minimos | cdc-apache-cassandra-fips-5.0 | 2.3.9-r0 |
| minimos | stargate | 2.0.51-r3 |
| minimos | stargate-fips | 2.0.51-r1 |
| Oracle Linux 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | düzeltme belirtilmemiş |
| rapidfort debian 12 | snakeyaml | düzeltme belirtilmemiş |
| rapidfort debian 13 | snakeyaml | düzeltme belirtilmemiş |
| Red Hat | candlepin | düzeltme belirtilmemiş |
| Red Hat | candlepin-selinux | düzeltme belirtilmemiş |
| Red Hat | jenkins-2-plugins | düzeltme belirtilmemiş |
| Red Hat | puppetserver | düzeltme belirtilmemiş |
| Red Hat | snakeyaml | düzeltme belirtilmemiş |
| Red Hat | snakeyaml-javadoc | düzeltme belirtilmemiş |
| rocky 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| seal Red Hat 7 | python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 7 | seal-python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 8 | libsolv | 0.7.20-6.el8+sp999 |
| seal Red Hat 8 | seal-libsolv | 0.7.20-6.el8+sp999 |
| wolfi | cassandra-4.1 | 0 |
| wolfi | cassandra-5.0 | 0 |
| wolfi | cassandra-reaper | 4.0.1-r1 |
| wolfi | druid | 0 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| wolfi | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
Referanslar
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://access.redhat.com/errata/RHSA-2022:9058
- https://access.redhat.com/security/cve/CVE-2022-1471
- https://advisory.echohq.com/cve/CVE-2022-1471
- https://bitbucket.org/snakeyaml/snakeyaml
- https://bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758
- https://bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4
33 referansın hepsi
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64876314
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE-2022-1471
- https://bugzilla.redhat.com/2150009
- https://bugzilla.redhat.com/show_bug.cgi?id=2150009
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1471
- https://errata.almalinux.org/8/ALSA-2022-9058.html
- https://errata.rockylinux.org/RLSA-2022:9058
- https://github.com/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/mbechler/marshalsec
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://linux.oracle.com/cve/CVE-2022-1471.html
- https://linux.oracle.com/errata/ELSA-2022-9058-1.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-1471
- https://security.netapp.com/advisory/ntap-20230818-0015
- https://security.netapp.com/advisory/ntap-20230818-0015/
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471
- https://www.cve.org/CVERecord?id=CVE-2022-1471
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true