CVE-2022-38752: DoS in SnakeYAML
A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.
Other sources
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DoS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
— GitHub
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-38752?
CVE-2022-38752 is a vulnerability in the snakeyaml package that allows for a denial of service attack by exploiting a stack-overflow in parsing YAML files.
How severe is CVE-2022-38752?
CVE-2022-38752 has a severity value of 6.5 (medium).
Which software versions are affected by CVE-2022-38752?
The versions affected by CVE-2022-38752 include eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el8ea, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el9ea, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el7ea, candlepin 4.2.13-1.el8, rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el7, rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el8, rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el9, Snakeyaml Project Snakeyaml 1.32, IBM Cloud Pak for Business Automation V22.0.2 - V22.0.2-IF001, IBM Cloud Pak for Business Automation V21.0.3 - V21.0.3-IF017, and IBM Cloud Pak for Business Automation V22.0.1 - V22.0.1-IF006 and later fixes, V21.0.2 - V21.0.2-IF012 and later fixes, V21.0.1 - V21.0.1-IF007 and later fixes, V20.0.1 - V20.0.3 and later fixes, V19.0.1 - V19.0.3 and later fixes, V18.0.0 - V18.0.2 and later fixes.
How can I fix CVE-2022-38752?
To fix CVE-2022-38752, update to the recommended versions: eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el8ea, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el9ea, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el7ea, candlepin 4.2.13-1.el8, rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el7, rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el8, rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el9, or follow the provided patches for IBM Cloud Pak for Business Automation versions.
What is the Common Weakness Enumeration (CWE) for CVE-2022-38752?
The Common Weakness Enumeration (CWE) for CVE-2022-38752 includes CWE-787 (Out-of-bounds Write) and CWE-121 (Stack-based Buffer Overflow).