CVE-2022-1471

Katalog CVE

CVSS 9.8 · Critical EPSS 99,6%

Kerentanan Improper Input Validation pada snakeyaml project snakeyaml. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Rincian

Terbit di NVD

1 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

99,6% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479 issue tracking · advisory pihak ketiga
• https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2 exploit · advisory pihak ketiga
• https://github.com/mbechler/marshalsec exploit · advisory pihak ketiga
• https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true exploit · advisory pihak ketiga
• http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Exec...
• http://www.openwall.com/lists/oss-security/2023/11/19/1
• https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-produc...
• https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
• https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
• https://security.netapp.com/advisory/ntap-20230818-0015/
• https://security.netapp.com/advisory/ntap-20240621-0006/