CVE-2022-1471
Aliases:GHSA-mjmj-j48q-9wg2RHSA-2022:9058DEBIAN-CVE-2022-1471CGA-256p-27pw-mpprCGA-2fh5-mffw-cgp2CGA-49r2-gwq7-q27vCGA-56pp-cxrj-vpf2CGA-673p-v9ph-v52xCGA-6c3x-g46f-vwh8CGA-7jwh-x7qm-vmj2CGA-974j-x96m-9fjpCGA-c4rw-rvwv-mhwfCGA-c6wx-g337-c6w8CGA-cx4x-qx5g-mmfpCGA-fx4w-hr9c-rj95CGA-hw3f-h32x-x5j9CGA-hx28-c5hg-hchfCGA-j8fj-pqfp-7vjvCGA-jfj4-xgfv-gg3hCGA-jh4h-hm28-45j6CGA-mc2c-w963-6r3pCGA-mfw7-r3mq-xc9vCGA-p58j-xrh8-hprmCGA-phhw-qxvx-xwrhCGA-pm9m-m5xg-ppqrCGA-pmq7-39rf-3x37CGA-2258-h6mm-6v7rCGA-24pc-p3wf-6c2wCGA-2686-3h2w-268vCGA-2859-r8vf-p5mpCGA-2c4j-r8v2-2x6mCGA-2fpx-p8p5-pjj2CGA-2g8g-rp65-434mCGA-2hfv-mj8g-5j49CGA-2hmf-f6m8-ph73CGA-2wg7-j6jw-f38hCGA-34vq-hh8x-cr7xCGA-3623-47p6-2x7pCGA-3f99-v734-ppqrCGA-3mjq-pc7g-32r2CGA-3prg-8rjj-mqvjCGA-3v69-2pfg-phfwCGA-49m8-pxc8-46f5CGA-4pfv-37w5-qx9vCGA-4rh7-wrqr-7774CGA-5g95-pv96-238jCGA-5h49-345h-46fxCGA-5hp2-pv65-9jcjCGA-5p92-m44j-wjhhCGA-5rph-pf95-3q25CGA-6698-q48p-38f2CGA-66rp-qvg8-wqvgCGA-69v4-j3p9-25c5CGA-6cp6-h7jr-jpv3CGA-6q99-gj2m-32j3CGA-6rvw-6x22-64hrCGA-728h-qhrf-mw5jCGA-74p6-qhf5-rcvcCGA-75cq-x9w2-5gvfCGA-7cmc-mmqv-f2wfCGA-83h8-rxg6-jmq4CGA-86vq-h66c-8j5wCGA-8rwf-9hwf-m6q3CGA-8vmv-g9jh-c4mfCGA-c484-8gq3-2qfwCGA-c4x3-7r5f-456xCGA-c84x-3h2r-mvxxCGA-cpqv-vm4q-mhc2CGA-crcq-f83m-phc8CGA-cwq6-95mj-7rghCGA-cx3f-jj72-vhhmCGA-f363-669q-gg6hCGA-fgmg-246h-762pCGA-fgp6-6gv5-v3rjCGA-g7gp-5p94-wv4pCGA-gh35-gppx-fqmjCGA-gjmw-9wjm-hx73CGA-h3q8-pgjg-c3c3CGA-h4j7-c2cj-3f88CGA-h6x7-wj8j-x872CGA-h8rr-2wrm-hwrpCGA-j6c5-pv7c-9fv3CGA-j779-327p-j6vqCGA-jc58-q5r5-g3v6CGA-jcfq-g4w4-33grCGA-jm34-xxw4-fw3fCGA-jpjh-chm5-8mwrCGA-m99g-pg58-5rpcCGA-mc3w-c8p5-xx7xCGA-mhjq-rrhv-rjh6CGA-mx7g-64m8-r347CGA-p7rw-v99r-5qprCGA-pfcm-47gr-3832CGA-pm6c-v2r8-ggjrCGA-pqfq-8mqv-7p3jCGA-q5j4-rrqg-rm2rCGA-qw7w-xp4x-mhr9CGA-qwh2-w2fw-xp5hCGA-qxrx-vphx-59jcCGA-r29j-hccc-r4qfCGA-r2f7-ppc7-wv3fCGA-r5x3-6q59-qgm7CGA-r963-234h-v85cCGA-rcm2-233f-qpmpCGA-rg6p-2x9w-q8f2CGA-rmjg-f965-547mCGA-rpx9-w24q-264wCGA-rrr4-27xq-r36wCGA-rvrm-jggx-7wwvCGA-v679-7w7g-cf4pCGA-v6hj-hfm4-v78jCGA-vjm6-w5j2-4rcrCGA-vm7j-cw9q-vv57CGA-vpxf-jcgc-hr8gCGA-w9qp-xfpw-ghgfCGA-wfq5-qh87-mmmmCGA-wrrm-vg69-c43qCGA-x49p-v7r6-42m2CGA-x5vh-6242-cxmqCGA-x63v-7x7j-2956CGA-x928-c97q-6ghcCGA-x96q-9rcw-67c9CGA-x9p2-8xpj-q8rmCGA-xg6f-7xf8-977mCGA-xg8g-5c6g-cp3jCGA-xhfq-6j34-4g8gCGA-xq5r-qpw6-4284CGA-xqxm-cpjx-85gmCGA-25hj-8vpq-4m35CGA-28f5-gwhx-h352CGA-2c84-qjqx-7x99CGA-2pwc-xr22-fg49CGA-34qg-5fx3-v29jCGA-45m9-mhvw-x6fwCGA-474q-wx35-xc62CGA-48v7-6vqx-7j27CGA-4cg7-89ff-hc6qCGA-4mc6-x2gq-q5wjCGA-4pjm-px8g-pwcjCGA-5c7r-48xf-mm95CGA-6q83-r8x4-678vCGA-6wf2-78fg-j3w4CGA-83w3-j25c-xg4vCGA-8rwg-fv34-3rcmCGA-9gpv-3hrw-7jf9CGA-9hr6-gc38-68fqCGA-9r67-9g62-6r6jCGA-c72p-6mwf-fgcrCGA-c7g3-2hgr-m4f4CGA-cmh2-gphx-wj94CGA-cqpw-qfp7-88xpCGA-g99f-r898-hrw7CGA-gfjw-xw55-7v6vCGA-ggcm-rhfj-9h4gCGA-gh77-cg6g-h22pCGA-gx2x-48x5-mh3rCGA-h235-3mvg-5hfwCGA-h8c6-xrr5-xqjpCGA-hj67-h596-xq2gCGA-hqqv-2mjq-h6qxCGA-j7q9-vw4q-2h6xCGA-jf6q-6w69-vhqpCGA-jfgv-7cx2-8g74CGA-mfqj-6h84-ff9rCGA-mpq8-m5vf-4xwxCGA-ph22-m678-xj9wCGA-qfpv-v6q6-2cjqCGA-rh58-wr7x-8x9rCGA-rw67-ffgp-rpmvCGA-v28v-2wv7-qgpxCGA-v3gw-fvrm-xxgwCGA-v9pf-7649-8c4cCGA-vhm2-3v9g-jw2jCGA-w5j2-843f-3j57CGA-w7mm-rpvw-wxwhCGA-xfmx-f393-gwc7CGA-2gqx-89pm-g7ggCGA-2mr9-2v53-67vvCGA-32xq-45g8-v5m5CGA-37cc-xm78-848cCGA-39m6-4h44-gf9jCGA-3hm4-wgw3-j4qpCGA-3ppj-2xg5-59hcCGA-3rhp-73h9-2hm9CGA-4725-wc2c-v97wCGA-47h5-jrm8-rcf6CGA-4p8q-66vq-5x79CGA-4rvh-27xm-6h2cCGA-59c6-qc7q-965fCGA-5m8g-j5x4-xcvpCGA-5q98-9xv7-2x4jCGA-6249-w2qr-qv94CGA-6cg2-87p5-jw2xCGA-6h5q-mpq8-gfwxCGA-6hg3-66h6-84w4CGA-6m69-2w34-32w6CGA-6qxq-x92h-p4p5CGA-6v66-fp8c-cqp7CGA-6w4j-xggr-jfg9CGA-78x5-33c3-c6mvCGA-79cg-hqfx-g85qCGA-7hr9-hxph-7w3hCGA-82vq-8378-84rhCGA-832f-xxr5-f6c5CGA-8596-65c5-59pmCGA-8824-8rqx-8w7mCGA-8wfx-999j-fmc4CGA-99px-vf56-3rqmCGA-9f2j-3v5m-7c45CGA-9j88-x86w-3v9hCGA-9v88-936g-494cCGA-chm4-q93x-3rxgCGA-cj98-r78q-h7g5CGA-cpf6-4j3x-w68fCGA-cq42-mxj7-f2m4CGA-f63c-g9p3-qgxxCGA-f7f4-g3x6-xcm9CGA-f878-2rr8-jvqhCGA-fmj3-mq6r-fg7jCGA-fr28-8gw7-gpmjCGA-g2vm-6738-rqh9CGA-g74f-mrgq-j46wCGA-ggq5-32wc-m88cCGA-gxwh-5fjp-xhqgCGA-h4f9-6339-9qcjCGA-h55f-j25q-hgf8CGA-h778-w2m2-jjxwCGA-h9v2-xjpj-g5gpCGA-hhgw-mf3f-c9j9CGA-j344-pmmv-r8cjCGA-m3qq-8pxm-2x74CGA-m7j9-v4qm-x9v2CGA-mg49-hw3r-qw55CGA-mr4r-979w-j898CGA-mrjc-7932-rj35CGA-mx8p-98ff-2rx5CGA-pc6f-frv6-cv24CGA-pg8j-c9fv-46g8CGA-ph69-jhp4-wvmmCGA-pmqh-2vfm-97xgCGA-px22-6j6h-24rjCGA-qc39-cx98-73h3CGA-qfvv-wqjc-jjhgCGA-rgqg-p69m-cp2jCGA-rp54-jxgx-vv2fCGA-vqxj-j849-f2vrCGA-vr74-h6gh-f453CGA-vr7q-fq7x-945qCGA-vwqp-c8pg-98w5CGA-w73f-q2ww-jmp9CGA-w86q-277g-gwjxCGA-w9q6-wf88-h947CGA-wj9x-hw65-xx6pCGA-xv5c-xfqc-rhw3CGA-xxq9-vhc7-fqqqCGA-2355-f6r6-6cg2CGA-23qr-f39r-q522CGA-33f4-m29p-jhq4CGA-3c3m-963w-pxmqCGA-3vmj-rgq6-vq85CGA-4c24-pm6h-gcp6CGA-4mc4-c272-8v9fCGA-542r-pmpv-vq9wCGA-54jh-3453-hqpvCGA-56c8-p8jg-g888CGA-584x-85c3-55h9CGA-646j-g5w2-9cjhCGA-67m4-c8mw-xpm5CGA-6q7x-mxfp-68p6CGA-779j-f369-g84cCGA-7cwq-52wp-crwhCGA-7wx7-xprf-v954CGA-83j8-q2vr-7vr8CGA-8jh4-vg8f-c2xvCGA-8phf-jvv5-c68mCGA-9gwf-4mf5-x9j3CGA-9qwr-ch45-mjpgCGA-c3fc-f8j8-745rCGA-cqmg-4v8m-qg2jCGA-fpm8-xrv6-w786CGA-fr9r-rx29-h5rcCGA-gg6v-pp7m-4q2mCGA-h626-4j8w-8w5xCGA-hcc4-r7pv-p6p9CGA-hfj4-mrw9-34fcCGA-hhq6-w4h4-c63vCGA-hmw9-93q4-64mvCGA-hr95-93ff-r94gCGA-j38j-hrf2-23r8CGA-jm99-5x9c-93qrCGA-jp35-7vqw-5wjjCGA-jqv9-7hff-h9wqCGA-m464-xgp9-f9q7CGA-mpqq-w722-66qcCGA-p2r3-cq8f-29prCGA-pg7x-f9m4-373cCGA-pr3q-6xrj-r87hCGA-pvcx-pp5x-w667CGA-qf7v-2377-pr3xCGA-r6rm-xr9h-m2pxCGA-r7h3-vg74-25pxCGA-rqv2-mp9r-qrw3CGA-v4g9-247r-q89wCGA-w6f6-93xf-g84rCGA-xgc9-gh5x-69wjCGA-xghq-cqrr-9rcwCGA-xh85-v7f8-vr75CGA-xxf2-8rqr-73pg
Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 01 Dec 2022, 10:47
Last modified:18 Jun 2025, 08:32
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
99.57% CRITICAL
100% probability +5.72%
KEV
Not listed
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected
Timeline
01 Dec 2022, 10:47
Published
Vulnerability first disclosed
18 Jun 2025, 08:32
Last Modified
Vulnerability information updated
Description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
CVSS Metrics
- v3.1•HIGH•Score: 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 99.57%• Percentile: 100%
Techniques & Countermeasures
- CWE-20•Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•cassandra-4.0
< 0
- chainguard•cassandra-4.1
< 0
- chainguard•cassandra-4.1-compat
< 0
- chainguard•cassandra-4.1-iamguarded-compat
< 0
- chainguard•cassandra-5.0
< 0
- chainguard•cassandra-5.0-compat
< 0
- chainguard•cassandra-5.0-entrypoint-compat
< 0
- chainguard•cassandra-5.0-iamguarded-compat
< 0
- chainguard•cassandra-fips-4.0
< 0
- chainguard•cassandra-fips-4.0-compat
< 0
- chainguard•cassandra-fips-4.1
< 0
- chainguard•cassandra-fips-4.1-compat
< 0
- chainguard•cassandra-fips-5.0
< 0
- chainguard•cassandra-fips-5.0-compat
< 0
- chainguard•cassandra-reaper
< 4.0.1-r1
- chainguard•cqlsh-5.0
< 0
- chainguard•cqlsh-fips-5.0
< 0
- chainguard•druid
< 0
- chainguard•eco-java-gradle-1.11
all
- chainguard•eco-java-gradle-2.0
all
- chainguard•eco-java-gradle-2.1
all
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.2
all
- chainguard•eco-java-gradle-2.2.1
all
- chainguard•eco-java-gradle-2.3
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
Showing first 50 affected entries in server-rendered view.
References (29)
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- https://github.com/mbechler/marshalsec
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://security.netapp.com/advisory/ntap-20230818-0015/
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-1471
- https://snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20230818-0015
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE-2022-1471
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64876314
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
- https://bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4
- https://bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758
- https://bitbucket.org/snakeyaml/snakeyaml
- https://access.redhat.com/errata/RHSA-2022:9058
- https://access.redhat.com/security/updates/classification/#important
- https://access.redhat.com/security/cve/CVE-2022-1471
- https://bugzilla.redhat.com/show_bug.cgi?id=2150009
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_9058.json
- https://www.cve.org/CVERecord?id=CVE-2022-1471
- https://security-tracker.debian.org/tracker/CVE-2022-1471
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1471.json