USN-5944-1: SnakeYAML vulnerabilities
10 March 2023
Several security issues were fixed in SnakeYAML.
Releases
Packages
- snakeyaml - YAML parser and emitter for the Java programming language
Details
It was discovered that SnakeYAML did not limit the maximal nested depth
for collections when parsing YAML data. If a user or automated system were
tricked into opening a specially crafted YAML file, an attacker could
possibly use this issue to cause applications using SnakeYAML to crash,
resulting in a denial of service. (CVE-2022-25857, CVE-2022-38749,
CVE-2022-38750)
It was discovered that SnakeYAML did not limit the maximal data matched
with regular expressions when parsing YAML data. If a user or automated
system were tricked into opening a specially crafted YAML file, an
attacker could possibly use this issue to cause applications using
SnakeYAML to crash, resulting in a denial of service. (CVE-2022-38751)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.10
Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04
Ubuntu 16.04
-
libyaml-snake-java
-
1.12-2ubuntu0.16.04.1~esm1
Available with Ubuntu Pro
Ubuntu 14.04
-
libyaml-snake-java
-
1.12-2ubuntu0.14.04.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.