High severity8.3NVD Advisory· Published Dec 1, 2022· Updated Jun 17, 2026
CVE-2022-1471
CVE-2022-1471
Description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.yaml:snakeyamlMaven | < 2.0 | 2.0 |
Affected products
59- osv-coords57 versionspkg:apk/wolfi/management-api-for-apache-cassandra-4.1pkg:apk/chainguard/druid-compatpkg:maven/org.yaml/snakeyamlpkg:apk/chainguard/cassandra-fips-4.1-compatpkg:apk/chainguard/cassandra-4.1pkg:apk/wolfi/cassandra-4.1pkg:apk/chainguard/cassandra-4.1-compatpkg:apk/wolfi/cassandra-4.1-compatpkg:apk/chainguard/management-api-for-apache-cassandra-4.0pkg:apk/chainguard/management-api-for-apache-cassandra-4.0-compatpkg:apk/wolfi/druid-compatpkg:apk/wolfi/druidpkg:apk/chainguard/druidpkg:apk/chainguard/request-1277pkg:apk/wolfi/cassandra-5.0pkg:apk/chainguard/elasticsearch-7pkg:apk/chainguard/cassandra-fips-4.1pkg:rpm/almalinux/prometheus-jmx-exporterpkg:rpm/almalinux/prometheus-jmx-exporter-openjdk11pkg:rpm/almalinux/prometheus-jmx-exporter-openjdk17pkg:rpm/almalinux/prometheus-jmx-exporter-openjdk8pkg:apk/chainguard/management-api-for-apache-cassandra-5.0pkg:apk/wolfi/management-api-for-apache-cassandra-5.0pkg:apk/chainguard/management-api-for-apache-cassandra-5.0-compatpkg:apk/wolfi/management-api-for-apache-cassandra-5.0-compatpkg:apk/wolfi/cassandra-5.0-entrypoint-compatpkg:apk/chainguard/jenkinspkg:apk/wolfi/jenkinspkg:apk/chainguard/jenkins-compatpkg:apk/wolfi/jenkins-compatpkg:apk/wolfi/jenkins-remotingpkg:apk/chainguard/cassandra-4.0pkg:apk/chainguard/cassandra-4.0-compatpkg:apk/chainguard/jenkins-remotingpkg:apk/chainguard/cassandra-4.1-iamguarded-compatpkg:apk/chainguard/cassandra-5.0pkg:apk/chainguard/cassandra-5.0-compatpkg:apk/chainguard/cassandra-5.0-entrypoint-compatpkg:apk/chainguard/cassandra-5.0-iamguarded-compatpkg:apk/chainguard/cassandra-fips-4.0pkg:apk/chainguard/cassandra-fips-4.0-compatpkg:apk/chainguard/cassandra-fips-5.0pkg:apk/chainguard/cassandra-fips-5.0-compatpkg:apk/chainguard/cassandra-reaperpkg:apk/chainguard/cqlsh-5.0pkg:apk/chainguard/cqlsh-fips-5.0pkg:apk/chainguard/elasticsearch-7-iamguardedpkg:apk/chainguard/management-api-for-apache-cassandra-4.1pkg:apk/chainguard/metric-collector-for-apache-cassandra-4.0pkg:apk/chainguard/metric-collector-for-apache-cassandra-4.1pkg:apk/chainguard/s3proxypkg:apk/chainguard/s3proxy-fipspkg:apk/wolfi/cassandra-5.0-compatpkg:apk/wolfi/cassandra-5.0-iamguarded-compatpkg:apk/wolfi/cassandra-reaperpkg:apk/wolfi/cqlsh-5.0pkg:apk/wolfi/metric-collector-for-apache-cassandra-4.1
< 0.1.109-r0+ 56 more
- (no CPE)range: < 0.1.109-r0
- (no CPE)range: < 0
- (no CPE)range: < 2.0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.1.89-r0
- (no CPE)range: < 0.1.89-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.1.89-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.12.0-9.el8_7
- (no CPE)range: < 0.12.0-9.el8_7
- (no CPE)range: < 0.12.0-9.el8_7
- (no CPE)range: < 0.12.0-9.el8_7
- (no CPE)range: < 0.1.89-r0
- (no CPE)range: < 0.1.89-r0
- (no CPE)range: < 0.1.89-r0
- (no CPE)range: < 0.1.89-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 4.0.1-r1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.1.109-r0
- (no CPE)range: < 0.3.6-r2
- (no CPE)range: < 0.3.6-r3
- (no CPE)range: < 3.3.0-r2
- (no CPE)range: < 3.3.0-r2
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 4.0.1-r1
- (no CPE)range: < 0
- (no CPE)range: < 0.3.6-r3
Patches
Vulnerability mechanics
References
19- github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2nvdExploitThird Party AdvisoryWEB
- www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdfnvdExploitThird Party AdvisoryWEB
- bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-innvdIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-mjmj-j48q-9wg2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-1471ghsaADVISORY
- packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.htmlnvdWEB
- www.openwall.com/lists/oss-security/2023/11/19/1nvdWEB
- bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758ghsaWEB
- bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4ghsaWEB
- bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-inghsaWEB
- bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-inghsaWEB
- confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.htmlnvdWEB
- groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdncnvdWEB
- infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4cnvdWEB
- security.netapp.com/advisory/ntap-20230818-0015ghsaWEB
- security.netapp.com/advisory/ntap-20240621-0006ghsaWEB
- snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471ghsaWEB
- security.netapp.com/advisory/ntap-20230818-0015/nvd
- security.netapp.com/advisory/ntap-20240621-0006/nvd
News mentions
0No linked articles in our index yet.