rpm package
suse/snakeyaml&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3
pkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-38752 | — | < 1.31-150200.3.8.1 | 1.31-150200.3.8.1 | Sep 5, 2022 | Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow. | ||
| CVE-2022-38751 | — | < 1.31-150200.3.8.1 | 1.31-150200.3.8.1 | Sep 5, 2022 | Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. | ||
| CVE-2022-38750 | — | < 1.31-150200.3.8.1 | 1.31-150200.3.8.1 | Sep 5, 2022 | Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. | ||
| CVE-2022-38749 | — | < 1.31-150200.3.8.1 | 1.31-150200.3.8.1 | Sep 5, 2022 | Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. | ||
| CVE-2022-25857 | — | < 1.31-150200.3.8.1 | 1.31-150200.3.8.1 | Aug 30, 2022 | The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. | ||
| CVE-2020-13936 | — | < 1.31-150200.3.8.1 | 1.31-150200.3.8.1 | Mar 10, 2021 | An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity template | ||
| CVE-2017-18640 | — | < 1.28-3.5.1 | 1.28-3.5.1 | Dec 12, 2019 | The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. |
- CVE-2022-38752Sep 5, 2022affected < 1.31-150200.3.8.1fixed 1.31-150200.3.8.1
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
- CVE-2022-38751Sep 5, 2022affected < 1.31-150200.3.8.1fixed 1.31-150200.3.8.1
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- CVE-2022-38750Sep 5, 2022affected < 1.31-150200.3.8.1fixed 1.31-150200.3.8.1
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- CVE-2022-38749Sep 5, 2022affected < 1.31-150200.3.8.1fixed 1.31-150200.3.8.1
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- CVE-2022-25857Aug 30, 2022affected < 1.31-150200.3.8.1fixed 1.31-150200.3.8.1
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
- CVE-2020-13936Mar 10, 2021affected < 1.31-150200.3.8.1fixed 1.31-150200.3.8.1
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity template
- CVE-2017-18640Dec 12, 2019affected < 1.28-3.5.1fixed 1.28-3.5.1
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.