by Kastro
Paper/Archive/CVE-2022-1471

CVE-2022-1471

SnakeYAML SnakeYAML — Remote Code execution in SnakeYAML

EPSS 100%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Affected

ProductAffectedFixed inSource
SnakeYAML≤ 2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Google (CNA)8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=truerefgithub.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2refbitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479refgithub.com/mbechler/marshalsecrefgroups.google.com/g/kubernetes-security-announce/c/mwrakFaEdncrefsecurity.netapp.com/advisory/ntap-20230818-0015refpacketstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.htmlrefopenwall.com/lists/oss-security/2023/11/19/1refsecurity.netapp.com/advisory/ntap-20240621-0006refinfosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4crefconfluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html