[Bug 2126789] New: CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

List overview All Threads
Download

newer

older

[Bug 2066479] New:...

[Bug 1955739] New: CVE-2021-26291...

bugzilla＠redhat.com

14 Sep 2022 14 Sep '22

12:18 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Bug ID: 2126789 Summary: CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections. Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: pdelbell@redhat.com CC: fedoraproject.org@bluhm-de.com, jaromir.capik@email.cz, java-sig-commits@lists.fedoraproject.org, jerboaa@gmail.com, mizdebsk@redhat.com, mo@morsi.org Target Milestone: --- Classification: Other

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Show replies by date

bugzilla＠redhat.com

14 Sep 14 Sep

12:19 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Patrick Del Bello pdelbell@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2123794

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

12:37 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Patrick Del Bello pdelbell@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2126793, 2126792, 2126794

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=2126792 [Bug 2126792] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections. [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126793 [Bug 2126793] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections. [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126794 [Bug 2126794] CVE-2022-25857 texlive-base: snakeyaml: Denial of Service due missing to nested depth limitation for collections. [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

12:37 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #1 from Patrick Del Bello pdelbell@redhat.com --- Created snakeyaml tracking bugs for this issue:

Affects: epel-all [bug 2126792] Affects: fedora-all [bug 2126793]

Created texlive-base tracking bugs for this issue:

Affects: fedora-all [bug 2126794]

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

2:06 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Doc Text *updated* by Patrick Del Bello pdelbell@redhat.com --- A flaw as found in org.yaml.snakeyaml package which affects versions until 1.30. This flaw allows an attacker to cause Denial of Service (DoS) due missing to nested depth limitation for collections.

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

2:23 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Sandipan Roy saroy@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2126842, 2126841

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

2:51 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

16 Sep 16 Sep

2:49 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Paramvir jindal pjindal@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |anstephe@redhat.com

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

2:07 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789 Bug 2126789 depends on bug 2126793, which changed state.

Bug 2126793 Summary: CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections. [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126793

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

20 Sep 20 Sep

4:48 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Sandipan Roy saroy@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2128144

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

28 Sep 28 Sep

4:04 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

spencer.deehring@ibm.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |spencer.deehring@ibm.com

--- Comment #8 from spencer.deehring@ibm.com --- Version 0.17.1 of prometheus-jmx-exporter was released about 3 weeks ago to fix this CVE in RHEL 8. Can we get an update to this package to patch this CVE?

https://github.com/prometheus/jmx_exporter/issues/734#issuecomment-124280521...

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:07 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Andrew John Hughes ahughes@redhat.com changed:

--- Comment #9 from Andrew John Hughes ahughes@redhat.com --- (In reply to spencer.deehring from comment #8)

...

Version 0.17.1 of prometheus-jmx-exporter was released about 3 weeks ago to fix this CVE in RHEL 8. Can we get an update to this package to patch this CVE?

https://github.com/prometheus/jmx_exporter/issues/734#issuecomment-124280521...

A rebuild with the new snakeyaml is in progress. See bug #2128477

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

29 Sep 29 Sep

2:42 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789 Bug 2126789 depends on bug 2126792, which changed state.

Bug 2126792 Summary: CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections. [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126792

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

30 Sep 30 Sep

8:18 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Paramvir jindal pjindal@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

5 Oct 5 Oct

2:50 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat build of Eclipse Vert.x 4.3.3

Via RHSA-2022:6757 https://access.redhat.com/errata/RHSA-2022:6757

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

2:50 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:32 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #16 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2022:6823 https://access.redhat.com/errata/RHSA-2022:6823

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:32 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:35 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2022:6821 https://access.redhat.com/errata/RHSA-2022:6821

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:35 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:39 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2022:6822 https://access.redhat.com/errata/RHSA-2022:6822

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:39 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:47 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #19 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform

Via RHSA-2022:6825 https://access.redhat.com/errata/RHSA-2022:6825

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

4:47 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

6 Oct 6 Oct

7:35 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #20 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 8

Via RHSA-2022:6820 https://access.redhat.com/errata/RHSA-2022:6820

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

7:35 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:44 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #21 from Sandipan Roy saroy@redhat.com --- For RHEL-8 it's downgraded to moderate because "snakeyaml" itself in RHEL 8 or RHEL-9 isn't shipped and "prometheus-jmx-exporter" is needed as build dependency. And it's not directly exploitable, hence severity marked as moderate.

https://access.redhat.com/security/updates/classification/#moderate

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

10:19 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

ybuenos@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

10:26 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

ybuenos@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2132653

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

12:28 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHINT Service Registry 2.3.0 GA

Via RHSA-2022:6835 https://access.redhat.com/errata/RHSA-2022:6835

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

12:28 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

5:26 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Chess Hazlett chazlett@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

13 Oct 13 Oct

11:14 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat build of Quarkus Platform 2.7.6.SP1

Via RHSA-2022:6941 https://access.redhat.com/errata/RHSA-2022:6941

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

11:14 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

14 Oct 14 Oct

6:23 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #28 from spencer.deehring@ibm.com --- I see that package prometheus-jmx-exporter has been updated in RHEL 8 to 0.12.0-8.el8_6 as per RHSA-2022:6820. However the sub package prometheus-jmx-exporter-openjdk8 has not been updated and still contains this CVE. Are there plans to resolve this?

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

17 Oct 17 Oct

8:48 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #29 from Severin Gehwolf sgehwolf@redhat.com --- (In reply to spencer.deehring from comment #28)

...

I see that package prometheus-jmx-exporter has been updated in RHEL 8 to 0.12.0-8.el8_6 as per RHSA-2022:6820. However the sub package prometheus-jmx-exporter-openjdk8 has not been updated and still contains this CVE. Are there plans to resolve this?

Sorry about that. This should not have happened. I'll get motions started to get relevant sub-package builds pushed as well. Appropriate root-cause analysis is ongoing why this happened in the first place. Thanks for letting us know!

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

24 Oct 24 Oct

1:13 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #31 from Severin Gehwolf sgehwolf@redhat.com --- (In reply to spencer.deehring from comment #28)

...

I see that package prometheus-jmx-exporter has been updated in RHEL 8 to 0.12.0-8.el8_6 as per RHSA-2022:6820. However the sub package prometheus-jmx-exporter-openjdk8 has not been updated and still contains this CVE. Are there plans to resolve this?

This should be fixed now:

[root@f3e8264d55a2 /]# dnf install prometheus-jmx-exporter-openjdk8 Updating Subscription Management repositories. Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Red Hat Universal Base Image 8 (RPMs) - BaseOS

2.2 MB/s | 811 kB 00:00 Red Hat Universal Base Image 8 (RPMs) - AppStream

6.1 MB/s | 3.0 MB 00:00 Red Hat Universal Base Image 8 (RPMs) - CodeReady Builder

119 kB/s | 20 kB 00:00 Dependencies resolved. ============================================================================================================================================================================================================================================== Package Architecture Version Repository Size ============================================================================================================================================================================================================================================== Installing: prometheus-jmx-exporter-openjdk8 noarch 0.12.0-8.el8_6 ubi-8-appstream-rpms 8.3 k Installing dependencies: avahi-libs x86_64 0.7-20.el8 ubi-8-baseos-rpms 62 k copy-jdk-configs noarch 4.0-2.el8 ubi-8-appstream-rpms 31 k cups-libs x86_64 1:2.2.6-45.el8_6.2 ubi-8-baseos-rpms 435 k freetype x86_64 2.9.1-4.el8_3.1 ubi-8-baseos-rpms 394 k java-1.8.0-openjdk-headless x86_64 1:1.8.0.352.b08-2.el8_6 ubi-8-appstream-rpms 34 M javapackages-filesystem noarch 5.3.0-1.module+el8+2447+6f56d9a6 ubi-8-appstream-rpms 30 k libjpeg-turbo x86_64 1.5.3-12.el8 ubi-8-appstream-rpms 157 k libpng x86_64 2:1.6.34-5.el8 ubi-8-baseos-rpms 126 k lksctp-tools x86_64 1.0.18-3.el8 ubi-8-baseos-rpms 100 k lua x86_64 5.3.4-12.el8 ubi-8-appstream-rpms 192 k nspr x86_64 4.34.0-3.el8_6 ubi-8-appstream-rpms 143 k nss x86_64 3.79.0-10.el8_6 ubi-8-appstream-rpms 747 k nss-softokn x86_64 3.79.0-10.el8_6 ubi-8-appstream-rpms 1.2 M nss-softokn-freebl x86_64 3.79.0-10.el8_6 ubi-8-appstream-rpms 398 k nss-sysinit x86_64 3.79.0-10.el8_6 ubi-8-appstream-rpms 75 k nss-util x86_64 3.79.0-10.el8_6 ubi-8-appstream-rpms 139 k prometheus-jmx-exporter noarch 0.12.0-8.el8_6 ubi-8-appstream-rpms 486 k tzdata-java noarch 2022e-1.el8 ubi-8-appstream-rpms 186 k Enabling module streams: javapackages-runtime 201801

Transaction Summary ============================================================================================================================================================================================================================================== Install 19 Packages

Total download size: 39 M Installed size: 129 M Is this ok [y/N]: n

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

17 Nov 17 Nov

1:40 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #35 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Data Grid 8.4.0

Via RHSA-2022:8524 https://access.redhat.com/errata/RHSA-2022:8524

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

1:40 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

28 Nov 28 Nov

2:40 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #37 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Fuse 7.11.1

Via RHSA-2022:8652 https://access.redhat.com/errata/RHSA-2022:8652

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

2:40 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

7 Dec 7 Dec

8:19 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #38 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss AMQ

Via RHSA-2022:8876 https://access.redhat.com/errata/RHSA-2022:8876

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

8:19 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9 Jan 9 Jan

3:47 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

Eric Helms ehelms@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2159443

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

7 Feb 7 Feb

5:01 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789 Bug 2126789 depends on bug 2126794, which changed state.

Bug 2126794 Summary: CVE-2022-25857 texlive-base: snakeyaml: Denial of Service due to missing nested depth limitation for collections [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126794

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

8 Feb 8 Feb

6:38 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #43 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat OpenShift Container Platform 4.10

Via RHSA-2023:0560 https://access.redhat.com/errata/RHSA-2023:0560

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

6:38 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

22 Feb 22 Feb

11:59 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #44 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat OpenShift Container Platform 4.9

Via RHSA-2023:0777 https://access.redhat.com/errata/RHSA-2023:0777

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

11:59 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

1 Mar 1 Mar

9:43 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #45 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Single Sign-On 7.6 for RHEL 7

Via RHSA-2023:1043 https://access.redhat.com/errata/RHSA-2023:1043

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:43 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:45 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #46 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Single Sign-On 7.6 for RHEL 8

Via RHSA-2023:1044 https://access.redhat.com/errata/RHSA-2023:1044

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:45 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:47 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #47 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Single Sign-On 7.6 for RHEL 9

Via RHSA-2023:1045 https://access.redhat.com/errata/RHSA-2023:1045

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:48 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:50 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #48 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHEL-8 based Middleware Containers

Via RHSA-2023:1047 https://access.redhat.com/errata/RHSA-2023:1047

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:50 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:58 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #49 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Single Sign-On

Via RHSA-2023:1049 https://access.redhat.com/errata/RHSA-2023:1049

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

9:59 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

21 Mar 21 Mar

2:41 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

3 May 3 May

1:19 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #53 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Satellite 6.13 for RHEL 8

Via RHSA-2023:2097 https://access.redhat.com/errata/RHSA-2023:2097

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

1:19 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

2:05 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #54 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHINT Camel-Springboot 3.20.1

Via RHSA-2023:2100 https://access.redhat.com/errata/RHSA-2023:2100

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

2:05 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

17 May 17 May

5:50 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #59 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

OpenShift Developer Tools and Services for OCP 4.11

Via RHSA-2023:3198 https://access.redhat.com/errata/RHSA-2023:3198

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

5:50 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

15 Jun 15 Jun

3:23 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #60 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHINT Camel-Springboot 3.18.3.P2

Via RHSA-2023:3641 https://access.redhat.com/errata/RHSA-2023:3641

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report...

bugzilla＠redhat.com

3:23 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

5 Sep 5 Sep

6:37 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #63 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHPAM 7.13.4 async

Via RHSA-2023:4983 https://access.redhat.com/errata/RHSA-2023:4983

bugzilla＠redhat.com

6:37 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

30 Oct 30 Oct

12:34 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #65 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

OpenShift Developer Tools and Services for OCP 4.13

Via RHSA-2023:6179 https://access.redhat.com/errata/RHSA-2023:6179

bugzilla＠redhat.com

12:35 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

15 Nov 15 Nov

7:24 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #66 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

OpenShift Developer Tools and Services for OCP 4.14

Via RHSA-2023:7288 https://access.redhat.com/errata/RHSA-2023:7288

bugzilla＠redhat.com

7:24 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

7 Dec 7 Dec

1:42 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #67 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

AMQ Clients 3.y for RHEL 8 AMQ Clients 3.y for RHEL 9

Via RHSA-2023:7697 https://access.redhat.com/errata/RHSA-2023:7697

bugzilla＠redhat.com

1:42 p.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

12 Feb 12 Feb

10:23 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #69 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

OpenShift Developer Tools and Services for OCP 4.13

Via RHSA-2024:0776 https://access.redhat.com/errata/RHSA-2024:0776

bugzilla＠redhat.com

10:23 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

10:25 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #70 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

OpenShift Developer Tools and Services for OCP 4.14

Via RHSA-2024:0777 https://access.redhat.com/errata/RHSA-2024:0777

bugzilla＠redhat.com

10:25 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

bugzilla＠redhat.com

10:36 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

--- Comment #71 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

OpenShift Developer Tools and Services for OCP 4.12

Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778

bugzilla＠redhat.com

10:36 a.m.

New subject: [Bug 2126789] CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

https://bugzilla.redhat.com/show_bug.cgi?id=2126789

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

302

Age (days ago)

818

Last active (days ago)

java-sig-commits@lists.fedoraproject.org

81 comments

1 participants

tags (0)

participants (1)

bugzilla＠redhat.com