Security update for snakeyaml SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3560-1 Final 1 1 2022-10-11T07:43:48Z current 2022-10-11T07:43:48Z 2022-10-11T07:43:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for snakeyaml This update for snakeyaml fixes the following issues: snakeyaml was upgraded to version 1.31: - CVE-2022-25857: Fixed DoS due missing to nested depth limitation for collections (bsc#1202932). - CVE-2022-38749: Fixed DoS due to stack overflow in parser (bsc#1202932). - CVE-2022-38751: Fixed DoS due to parsing of untrusted yaml files (bsc#1203153). - CVE-2022-38752: Fixed DoS due to stack overflow in parser (bsc#1203154). - CVE-2022-38750: Fixed DoS due to parsing of untrusted yaml files (bsc#1203158). - CVE-2020-13936: Fixed arbitrary code execution when attacker is able to modify templates (bsc#1183360). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3560,SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3560 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223560-1/ Link for SUSE-SU-2022:3560-1 https://lists.suse.com/pipermail/sle-security-updates/2022-October/012531.html E-Mail link for SUSE-SU-2022:3560-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1183360 SUSE Bug 1183360 https://bugzilla.suse.com/1202932 SUSE Bug 1202932 https://bugzilla.suse.com/1203149 SUSE Bug 1203149 https://bugzilla.suse.com/1203153 SUSE Bug 1203153 https://bugzilla.suse.com/1203154 SUSE Bug 1203154 https://bugzilla.suse.com/1203158 SUSE Bug 1203158 https://www.suse.com/security/cve/CVE-2020-13936/ SUSE CVE CVE-2020-13936 page https://www.suse.com/security/cve/CVE-2022-25857/ SUSE CVE CVE-2022-25857 page https://www.suse.com/security/cve/CVE-2022-38749/ SUSE CVE CVE-2022-38749 page https://www.suse.com/security/cve/CVE-2022-38750/ SUSE CVE CVE-2022-38750 page https://www.suse.com/security/cve/CVE-2022-38751/ SUSE CVE CVE-2022-38751 page https://www.suse.com/security/cve/CVE-2022-38752/ SUSE CVE CVE-2022-38752 page SUSE Manager Server Module 4.1 snakeyaml-1.31-150200.12.6.1 snakeyaml-javadoc-1.31-150200.12.6.1 snakeyaml-1.31-150200.12.6.1 as a component of SUSE Manager Server Module 4.1 An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2. CVE-2020-13936 SUSE Manager Server Module 4.1:snakeyaml-1.31-150200.12.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223560-1/ https://www.suse.com/security/cve/CVE-2020-13936.html CVE-2020-13936 https://bugzilla.suse.com/1183360 SUSE Bug 1183360 The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. CVE-2022-25857 SUSE Manager Server Module 4.1:snakeyaml-1.31-150200.12.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223560-1/ https://www.suse.com/security/cve/CVE-2022-25857.html CVE-2022-25857 https://bugzilla.suse.com/1202932 SUSE Bug 1202932 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38749 SUSE Manager Server Module 4.1:snakeyaml-1.31-150200.12.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223560-1/ https://www.suse.com/security/cve/CVE-2022-38749.html CVE-2022-38749 https://bugzilla.suse.com/1203149 SUSE Bug 1203149 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38750 SUSE Manager Server Module 4.1:snakeyaml-1.31-150200.12.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223560-1/ https://www.suse.com/security/cve/CVE-2022-38750.html CVE-2022-38750 https://bugzilla.suse.com/1203158 SUSE Bug 1203158 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38751 SUSE Manager Server Module 4.1:snakeyaml-1.31-150200.12.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223560-1/ https://www.suse.com/security/cve/CVE-2022-38751.html CVE-2022-38751 https://bugzilla.suse.com/1203153 SUSE Bug 1203153 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow. CVE-2022-38752 SUSE Manager Server Module 4.1:snakeyaml-1.31-150200.12.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223560-1/ https://www.suse.com/security/cve/CVE-2022-38752.html CVE-2022-38752 https://bugzilla.suse.com/1203154 SUSE Bug 1203154