Vulnerability Description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Snakeyaml Project | Snakeyaml | < 2.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-De
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerabilityIssue TrackingThird Party Advisory
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vu
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9ExploitThird Party Advisory
- https://github.com/mbechler/marshalsecExploitThird Party Advisory
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakey
- https://security.netapp.com/advisory/ntap-20230818-0015/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=trueExploitThird Party Advisory
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-De
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerabilityIssue TrackingThird Party Advisory
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9ExploitThird Party Advisory
FAQ
What is CVE-2022-1471?
CVE-2022-1471 is a vulnerability with a CVSS score of 8.3 (HIGH). SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recom...
How severe is CVE-2022-1471?
CVE-2022-1471 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-1471?
Check the references section above for vendor advisories and patch information. Affected products include: Snakeyaml Project Snakeyaml.