https://bugzilla.redhat.com/show_bug.cgi?id=2126789
Bug ID: 2126789 Summary: CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections. Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: pdelbell@redhat.com CC: fedoraproject.org@bluhm-de.com, jaromir.capik@email.cz, java-sig-commits@lists.fedoraproject.org, jerboaa@gmail.com, mizdebsk@redhat.com, mo@morsi.org Target Milestone: --- Classification: Other
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.