Most recent entries from all

ALSA-2022:6820 — Moderate: prometheus-jmx-exporter security update

Affected: AlmaLinux:8: prometheus-jmx-exporter, AlmaLinux:8: prometheus-jmx-exporter-openjdk11

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.

Security Fix(es):

* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-05621

certfr-2023-avi-0034 — De multiples vulnérabilités ont été découvertes dans les produits Oracle. Certaines d'entre elles permettent à un attaq…

certfr-2023-avi-0034

EUVD-2026-173298

fkie_cve-2022-25857

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

GHSA-3mc7-4q67-w48m — Uncontrolled Resource Consumption in snakeyaml

Affected: Maven: org.yaml:snakeyaml

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

gsd-2022-25857

msrc_CVE-2022-25857 — Denial of Service (DoS)

msrc_CVE-2022-25857

OESA-2023-1162 — snakeyaml security update

Affected: openEuler:22.03-LTS: snakeyaml

SnakeYAML is a YAML parser and emitter for the Java Virtual Machine. YAML is a data serialization format designed for human readability and interaction with scripting languages. Security Fix(es): The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.(CVE-2022-25857) Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.(CVE-2022-38749) Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.(CVE-2022-38750) Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.(CVE-2022-38751) Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.(CVE-2022-38752)

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running…

openSUSE-SU-2024:12308-1 — snakeyaml-1.31-1.1 on GA media

snakeyaml-1.31-1.1 on GA media

RHSA-2022:6757 — Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.3.3 security update

snakeyaml: Denial of Service due to missing nested depth limitation for collections graphql-java: DoS by malicious query snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode

SUSE-SU-2022:3560-1 — Security update for snakeyaml

Security update for snakeyaml

UBUNTU-CVE-2022-25857

Affected: Ubuntu:Pro:14.04:LTS: snakeyaml, Ubuntu:Pro:16.04:LTS: snakeyaml, Ubuntu:18.04:LTS: snakeyaml, Ubuntu:20.04:LTS: snakeyaml, Ubuntu:22.04:LTS: snakeyaml

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

WID-SEC-W-2022-1635 — Red Hat OpenShift und Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift build of Eclipse Vert.x und Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.