Description
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
Remediation
References
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/
https://security.netapp.com/advisory/ntap-20240315-0009/
https://security.netapp.com/advisory/ntap-20240621-0006/
Related Vulnerabilities
CVE-2022-31160 Vulnerability in maven package org.webjars:jquery-ui
CVE-2023-22621 Vulnerability in npm package @strapi/plugin-email
CVE-2022-4350 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2020-7615 Vulnerability in npm package fsa
CVE-2022-36437 Vulnerability in maven package com.hazelcast.jet:hazelcast-jet-enterprise