Uploaded image for project: 'Commons Configuration'
  1. Commons Configuration
  2. CONFIGURATION-829

Critical security vulnerability in snakeyaml

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 2.8.0
    • 2.9.0
    • File reloading
    • None

    Description

      This vulnerability is fixed in snakeyaml 2.0 and requires a backwards incompatible change in the constructor
      https://nvd.nist.gov/vuln/detail/CVE-2022-1471

       

      SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.

      Attachments

        Activity

          People

            Unassigned Unassigned
            acoady Aaron Coady
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: