Security update for snakeyaml SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3397-1 Final 1 1 2022-09-26T14:39:22Z current 2022-09-26T14:39:22Z 2022-09-26T14:39:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for snakeyaml This update for snakeyaml fixes the following issues: - CVE-2022-38750: Fixed uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (bsc#1203158). - CVE-2022-38749: Fixed StackOverflowError for many open unmatched brackets (bsc#1203149). - CVE-2022-38752: Fixed uncaught exception in java.base/java.util.ArrayList.hashCode (bsc#1203154). - CVE-2022-38751: Fixed unrestricted data matched with Regular Expressions (bsc#1203153). - CVE-2022-25857: Fixed denial of service vulnerability due missing to nested depth limitation for collections (bsc#1202932). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2022-3397,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2022-3397,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2022-3397,Image SLES15-SP4-Manager-Server-4-3-BYOS-2022-3397,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2022-3397,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2022-3397,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2022-3397,SUSE-2022-3397,SUSE-SLE-Module-Development-Tools-15-SP3-2022-3397,SUSE-SLE-Module-Development-Tools-15-SP4-2022-3397,SUSE-SLE-Module-SUSE-Manager-Server-4.2-2022-3397,SUSE-SLE-Module-SUSE-Manager-Server-4.3-2022-3397,openSUSE-SLE-15.3-2022-3397,openSUSE-SLE-15.4-2022-3397 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223397-1/ Link for SUSE-SU-2022:3397-1 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012382.html E-Mail link for SUSE-SU-2022:3397-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202932 SUSE Bug 1202932 https://bugzilla.suse.com/1203149 SUSE Bug 1203149 https://bugzilla.suse.com/1203153 SUSE Bug 1203153 https://bugzilla.suse.com/1203154 SUSE Bug 1203154 https://bugzilla.suse.com/1203158 SUSE Bug 1203158 https://www.suse.com/security/cve/CVE-2020-13936/ SUSE CVE CVE-2020-13936 page https://www.suse.com/security/cve/CVE-2022-25857/ SUSE CVE CVE-2022-25857 page https://www.suse.com/security/cve/CVE-2022-38749/ SUSE CVE CVE-2022-38749 page https://www.suse.com/security/cve/CVE-2022-38750/ SUSE CVE CVE-2022-38750 page https://www.suse.com/security/cve/CVE-2022-38751/ SUSE CVE CVE-2022-38751 page https://www.suse.com/security/cve/CVE-2022-38752/ SUSE CVE CVE-2022-38752 page Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Manager Server Module 4.2 SUSE Manager Server Module 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 snakeyaml-1.31-150200.3.8.1 snakeyaml-javadoc-1.31-150200.3.8.1 snakeyaml-1.31-150200.3.8.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure snakeyaml-1.31-150200.3.8.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM snakeyaml-1.31-150200.3.8.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE snakeyaml-1.31-150200.3.8.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS snakeyaml-1.31-150200.3.8.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure snakeyaml-1.31-150200.3.8.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 snakeyaml-1.31-150200.3.8.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE snakeyaml-1.31-150200.3.8.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 snakeyaml-1.31-150200.3.8.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 snakeyaml-1.31-150200.3.8.1 as a component of SUSE Manager Server Module 4.2 snakeyaml-1.31-150200.3.8.1 as a component of SUSE Manager Server Module 4.3 snakeyaml-1.31-150200.3.8.1 as a component of openSUSE Leap 15.3 snakeyaml-javadoc-1.31-150200.3.8.1 as a component of openSUSE Leap 15.3 snakeyaml-1.31-150200.3.8.1 as a component of openSUSE Leap 15.4 snakeyaml-javadoc-1.31-150200.3.8.1 as a component of openSUSE Leap 15.4 An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2. CVE-2020-13936 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.2:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-javadoc-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-javadoc-1.31-150200.3.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223397-1/ https://www.suse.com/security/cve/CVE-2020-13936.html CVE-2020-13936 https://bugzilla.suse.com/1183360 SUSE Bug 1183360 The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. CVE-2022-25857 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.2:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-javadoc-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-javadoc-1.31-150200.3.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223397-1/ https://www.suse.com/security/cve/CVE-2022-25857.html CVE-2022-25857 https://bugzilla.suse.com/1202932 SUSE Bug 1202932 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38749 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.2:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-javadoc-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-javadoc-1.31-150200.3.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223397-1/ https://www.suse.com/security/cve/CVE-2022-38749.html CVE-2022-38749 https://bugzilla.suse.com/1203149 SUSE Bug 1203149 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38750 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.2:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-javadoc-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-javadoc-1.31-150200.3.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223397-1/ https://www.suse.com/security/cve/CVE-2022-38750.html CVE-2022-38750 https://bugzilla.suse.com/1203158 SUSE Bug 1203158 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38751 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.2:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-javadoc-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-javadoc-1.31-150200.3.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223397-1/ https://www.suse.com/security/cve/CVE-2022-38751.html CVE-2022-38751 https://bugzilla.suse.com/1203153 SUSE Bug 1203153 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow. CVE-2022-38752 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:snakeyaml-1.31-150200.3.8.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:snakeyaml-1.31-150200.3.8.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.2:snakeyaml-1.31-150200.3.8.1 SUSE Manager Server Module 4.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.3:snakeyaml-javadoc-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-1.31-150200.3.8.1 openSUSE Leap 15.4:snakeyaml-javadoc-1.31-150200.3.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223397-1/ https://www.suse.com/security/cve/CVE-2022-38752.html CVE-2022-38752 https://bugzilla.suse.com/1203154 SUSE Bug 1203154