CVE-2022-1471 (Critical) detected in snakeyaml-1.14.jar #357
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
Status: Needs Triage
CVE-2022-1471 - Critical Severity Vulnerability
YAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /modules/objectmappers-smooks/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.14/snakeyaml-1.14.jar
Dependency Hierarchy:
Found in HEAD commit: f8ec948423b9447cfa8c211fc94d011f6f24e137
Found in base branch: master
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Publish Date: 2022-12-01
URL: CVE-2022-1471
Base Score Metrics:
Type: Upgrade version
Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
Release Date: 2022-12-01
Fix Resolution: org.yaml:snakeyaml:2.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: