critical
CVE-2022-1471
SnakeYaml: Constructor Deserialization Remote Code Execution
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high), AlmaLinux (high), Oracle (high), Rocky Linux (high).
Description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 and 1 more | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0, cassandra-4.1, cassandra-5.0 and 13 more | 0 and 6 more |
| debian 11 | snakeyaml | no fix listed |
| debian 12 | snakeyaml | no fix listed |
| debian 13 | snakeyaml | no fix listed |
| debian 14 | snakeyaml | no fix listed |
| echo | snakeyaml | no fix listed |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid, apache-druid-fips, cdc-apache-cassandra-5.0 and 3 more | 37.0.0-r1 and 3 more |
| Oracle Linux 8 | prometheus-jmx-exporter, prometheus-jmx-exporter-openjdk11, prometheus-jmx-exporter-openjdk17 and 1 more | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | no fix listed |
Show all 60 entries from 19 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| alma 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| chainguard | cassandra-4.0 | 0 |
| chainguard | cassandra-4.1 | 0 |
| chainguard | cassandra-5.0 | 0 |
| chainguard | cassandra-fips-4.0 | 0 |
| chainguard | cassandra-fips-4.1 | 0 |
| chainguard | cassandra-fips-5.0 | 0 |
| chainguard | cassandra-reaper | 4.0.1-r1 |
| chainguard | druid | 0 |
| chainguard | elasticsearch-7 | 0 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0.1.89-r0 |
| chainguard | management-api-for-apache-cassandra-4.1 | 0.1.109-r0 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| chainguard | metric-collector-for-apache-cassandra-4.0 | 0.3.6-r2 |
| chainguard | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
| chainguard | s3proxy | 3.3.0-r2 |
| chainguard | s3proxy-fips | 3.3.0-r2 |
| debian 11 | snakeyaml | no fix listed |
| debian 12 | snakeyaml | no fix listed |
| debian 13 | snakeyaml | no fix listed |
| debian 14 | snakeyaml | no fix listed |
| echo | snakeyaml | no fix listed |
| echo maven::Echo OSV | org.yaml:snakeyaml | 2.0 |
| maven::GitHub Security Advisory Maven | org.yaml:snakeyaml | 2.0 |
| minimos | apache-druid | 37.0.0-r1 |
| minimos | apache-druid-fips | 37.0.0-r1 |
| minimos | cdc-apache-cassandra-5.0 | 2.3.9-r0 |
| minimos | cdc-apache-cassandra-fips-5.0 | 2.3.9-r0 |
| minimos | stargate | 2.0.51-r3 |
| minimos | stargate-fips | 2.0.51-r1 |
| Oracle Linux 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| Oracle Linux 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| rapidfort amazon linux 2023 | snakeyaml | no fix listed |
| rapidfort debian 12 | snakeyaml | no fix listed |
| rapidfort debian 13 | snakeyaml | no fix listed |
| Red Hat | candlepin | no fix listed |
| Red Hat | candlepin-selinux | no fix listed |
| Red Hat | jenkins-2-plugins | no fix listed |
| Red Hat | puppetserver | no fix listed |
| Red Hat | snakeyaml | no fix listed |
| Red Hat | snakeyaml-javadoc | no fix listed |
| rocky 8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 |
| rocky 8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 |
| seal Red Hat 7 | python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 7 | seal-python-jinja2 | 2.7.2-4.el7+sp999 |
| seal Red Hat 8 | libsolv | 0.7.20-6.el8+sp999 |
| seal Red Hat 8 | seal-libsolv | 0.7.20-6.el8+sp999 |
| wolfi | cassandra-4.1 | 0 |
| wolfi | cassandra-5.0 | 0 |
| wolfi | cassandra-reaper | 4.0.1-r1 |
| wolfi | druid | 0 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.89-r0 |
| wolfi | metric-collector-for-apache-cassandra-4.1 | 0.3.6-r3 |
References
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://access.redhat.com/errata/RHSA-2022:9058
- https://access.redhat.com/security/cve/CVE-2022-1471
- https://advisory.echohq.com/cve/CVE-2022-1471
- https://bitbucket.org/snakeyaml/snakeyaml
- https://bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758
- https://bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4
All 33 references
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64876314
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE-2022-1471
- https://bugzilla.redhat.com/2150009
- https://bugzilla.redhat.com/show_bug.cgi?id=2150009
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1471
- https://errata.almalinux.org/8/ALSA-2022-9058.html
- https://errata.rockylinux.org/RLSA-2022:9058
- https://github.com/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/mbechler/marshalsec
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://linux.oracle.com/cve/CVE-2022-1471.html
- https://linux.oracle.com/errata/ELSA-2022-9058-1.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-1471
- https://security.netapp.com/advisory/ntap-20230818-0015
- https://security.netapp.com/advisory/ntap-20230818-0015/
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471
- https://www.cve.org/CVERecord?id=CVE-2022-1471
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true