Bug 1202932 - (CVE-2022-25857) VUL-0: CVE-2022-25857: snakeyaml: snakeyaml vulnerable to DoS due missing to nested depth limitation for collections
(CVE-2022-25857)
VUL-0: CVE-2022-25857: snakeyaml: snakeyaml vulnerable to DoS due missing to ...
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/341135/
CVSSv3.1:SUSE:CVE-2022-25857:6.2:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-08-30 13:31 UTC by Hu
Modified: 2022-10-11 13:21 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Hu 2022-08-30 13:31:39 UTC
Affected:
- SUSE:SLE-15-SP2:Update/snakeyaml                            1.28
- SUSE:SLE-15-SP2:Update:Products:Manager41:Update/snakeyaml  1.28
- openSUSE:Factory/snakeyaml                                  1.28
Comment 6 Swamp Workflow Management 2022-09-26 19:29:20 UTC
SUSE-SU-2022:3397-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1202932,1203149,1203153,1203154,1203158
CVE References: CVE-2020-13936,CVE-2022-25857,CVE-2022-38749,CVE-2022-38750,CVE-2022-38751,CVE-2022-38752
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    snakeyaml-1.31-150200.3.8.1
openSUSE Leap 15.3 (src):    snakeyaml-1.31-150200.3.8.1
SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (src):    snakeyaml-1.31-150200.3.8.1
SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (src):    snakeyaml-1.31-150200.3.8.1
SUSE Linux Enterprise Module for Development Tools 15-SP4 (src):    snakeyaml-1.31-150200.3.8.1
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    snakeyaml-1.31-150200.3.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2022-10-11 13:21:37 UTC
SUSE-SU-2022:3560-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1183360,1202932,1203149,1203153,1203154,1203158
CVE References: CVE-2020-13936,CVE-2022-25857,CVE-2022-38749,CVE-2022-38750,CVE-2022-38751,CVE-2022-38752
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (src):    snakeyaml-1.31-150200.12.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.