Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2022-1471
Modified
More InfoOfficial Page
Source-cve-coordination@google.com
View Known Exploited Vulnerability (KEV) details
Published At-01 Dec, 2022 | 11:15
Updated At-18 Jun, 2025 | 09:15

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.3HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Primary3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.3
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Type: Primary
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE Matches
snakeyaml_project
snakeyaml_project
>>snakeyaml>>Versions before 2.0(exclusive)
cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-20Secondarycve-coordination@google.com
CWE-502Primarynvd@nist.gov
CWE ID: CWE-20
Type: Secondary
Source: cve-coordination@google.com
CWE ID: CWE-502
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.htmlcve-coordination@google.com
N/A
http://www.openwall.com/lists/oss-security/2023/11/19/1cve-coordination@google.com
N/A
https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479cve-coordination@google.com
Issue Tracking
Third Party Advisory
https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.htmlcve-coordination@google.com
N/A
https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2cve-coordination@google.com
Exploit
Third Party Advisory
https://github.com/mbechler/marshalseccve-coordination@google.com
Exploit
Third Party Advisory
https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnccve-coordination@google.com
N/A
https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4ccve-coordination@google.com
N/A
https://security.netapp.com/advisory/ntap-20230818-0015/cve-coordination@google.com
N/A
https://security.netapp.com/advisory/ntap-20240621-0006/cve-coordination@google.com
N/A
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=truecve-coordination@google.com
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2023/11/19/1af854a3a-2127-422b-91ae-364da2661108
N/A
https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Third Party Advisory
https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2af854a3a-2127-422b-91ae-364da2661108
Exploit
Third Party Advisory
https://github.com/mbechler/marshalsecaf854a3a-2127-422b-91ae-364da2661108
Exploit
Third Party Advisory
https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdncaf854a3a-2127-422b-91ae-364da2661108
N/A
https://security.netapp.com/advisory/ntap-20230818-0015/af854a3a-2127-422b-91ae-364da2661108
N/A
https://security.netapp.com/advisory/ntap-20240621-0006/af854a3a-2127-422b-91ae-364da2661108
N/A
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=trueaf854a3a-2127-422b-91ae-364da2661108
Exploit
Third Party Advisory
Hyperlink: http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
Source: cve-coordination@google.com
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2023/11/19/1
Source: cve-coordination@google.com
Resource: N/A
Hyperlink: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
Source: cve-coordination@google.com
Resource:
Issue Tracking
Third Party Advisory
Hyperlink: https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
Source: cve-coordination@google.com
Resource: N/A
Hyperlink: https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
Source: cve-coordination@google.com
Resource:
Exploit
Third Party Advisory
Hyperlink: https://github.com/mbechler/marshalsec
Source: cve-coordination@google.com
Resource:
Exploit
Third Party Advisory
Hyperlink: https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
Source: cve-coordination@google.com
Resource: N/A
Hyperlink: https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
Source: cve-coordination@google.com
Resource: N/A
Hyperlink: https://security.netapp.com/advisory/ntap-20230818-0015/
Source: cve-coordination@google.com
Resource: N/A
Hyperlink: https://security.netapp.com/advisory/ntap-20240621-0006/
Source: cve-coordination@google.com
Resource: N/A
Hyperlink: https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Source: cve-coordination@google.com
Resource:
Exploit
Third Party Advisory
Hyperlink: http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2023/11/19/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Issue Tracking
Third Party Advisory
Hyperlink: https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Third Party Advisory
Hyperlink: https://github.com/mbechler/marshalsec
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Third Party Advisory
Hyperlink: https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://security.netapp.com/advisory/ntap-20230818-0015/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://security.netapp.com/advisory/ntap-20240621-0006/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Third Party Advisory
Change History
0Changes found
Details not found