Most recent entries from all

ALSA-2022:9058 — Important: prometheus-jmx-exporter security update

Affected: AlmaLinux:8: prometheus-jmx-exporter, AlmaLinux:8: prometheus-jmx-exporter-openjdk11, AlmaLinux:8: prometheus-jmx-exporter-openjdk17, AlmaLinux:8: prometheus-jmx-exporter-openjdk8

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.

Security Fix(es):

* SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-00013

certfr-2023-avi-0287 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Elles permettent à u…

certfr-2023-avi-0287

Withdrawn: CLEANSTART-2026-CI66802 — Security fixes for CVE-2015-2104, CVE-2020-8908, CVE-2021-21295, CVE-2021-21409, CVE-2021-37136, CVE-2022-1471, CVE-202…

Withdrawn by the publisher.

Affected: CleanStart: cassandra-fips

Multiple security vulnerabilities affect the cassandra-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-245037

fkie_cve-2022-1471

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

GHSA-mjmj-j48q-9wg2 — SnakeYaml Constructor Deserialization Remote Code Execution

Affected: Maven: org.yaml:snakeyaml

### Summary SnakeYaml's `Constructor` class, which inherits from `SafeConstructor`, allows any type be deserialized given the following line:

new Yaml(new Constructor(TestDataClass.class)).load(yamlContent);

Types do not have to match the types of properties in the target class. A `ConstructorException` is thrown, but only after a malicious payload is deserialized.

### Severity High, lack of type checks during deserialization allows remote code execution.

### Proof of Concept Execute `bash run.sh`. The PoC uses Constructor to deserialize a payload for RCE. RCE is demonstrated by using a payload which performs a http request to http://127.0.0.1:8000.

Example output of successful run of proof of concept:

``` $ bash run.sh

[+] Downloading snakeyaml if needed [+] Starting mock HTTP server on 127.0.0.1:8000 to demonstrate RCE nc: no process found [+] Compiling and running Proof of Concept, which a payload that sends a HTTP request to mock web server. [+] An exception is expected. Exception: Cannot create property=payload for JavaBean=Main$TestDataClass@3cbbc1e0 in 'string', line 1, column 1: payload: !!javax.script.ScriptEn ... ^ Can not set java.lang.String field Main$TestDataClass.payload to javax.script.ScriptEngineManager in 'string', line 1, column 10: payload: !!javax.script.ScriptEngineManag ... ^

at org.yaml.snakeyaml.constructor.Constructor$ConstructMapping.constructJavaBean2ndStep(Constructor.java:291) at org.yaml.snakeyaml.constru…

gsd-2022-1471

openSUSE-SU-2024:13151-1 — jackson-dataformat-csv-2.15.2-1.1 on GA media

jackson-dataformat-csv-2.15.2-1.1 on GA media

RHBA-2023:0030 — Red Hat Bug Fix Advisory: updated RHEL-8 based Middleware Containers container images

SnakeYaml: Constructor Deserialization Remote Code Execution

UBUNTU-CVE-2022-1471

Affected: Ubuntu:Pro:14.04:LTS: snakeyaml, Ubuntu:Pro:16.04:LTS: snakeyaml, Ubuntu:Pro:18.04:LTS: snakeyaml, Ubuntu:Pro:20.04:LTS: snakeyaml, Ubuntu:22.04:LTS: snakeyaml, Ubuntu:24.04:LTS: snakeyaml

WID-SEC-W-2022-2347 — Red Hat Enterprise Linux: Schwachstelle ermöglicht Codeausführung

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux und Oracle Linux ausnutzen, um beliebigen Programmcode auszuführen.