HIGH7.5

GHSA-3mc7-4q67-w48m

Uncontrolled Resource Consumption in snakeyaml

Quick fix

GHSA-3mc7-4q67-w48m — org.yaml:snakeyaml: upgrade to the fixed version with the command below.

# pom.xml: bump <version>1.31</version> for org.yaml:snakeyaml

Details

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.yaml:snakeyaml

Introduced in: 0Fixed in: 1.31

Fix# pom.xml: bump <version>1.31</version> for org.yaml:snakeyaml

References

https://nvd.nist.gov/vuln/detail/CVE-2022-25857[ADVISORY]
https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174[WEB]
https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174[WEB]
https://bitbucket.org/snakeyaml/snakeyaml/issues/525[WEB]
https://github.com/snakeyaml/snakeyaml[PACKAGE]
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html[WEB]
https://security.netapp.com/advisory/ntap-20240315-0010[WEB]
https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360[WEB]