CVE-2022-25857

Aliases:GHSA-3mc7-4q67-w48mRHSA-2022:6820DEBIAN-CVE-2022-25857CGA-3ghg-8hwx-hqpfCGA-48pm-2cj6-qwhhCGA-4qrv-m5fg-xjmgCGA-5ccq-whf7-4q2wCGA-8p88-p94c-vc4cCGA-9578-54w7-jhw3CGA-f7gp-m67m-r8cqCGA-g629-m243-pghxCGA-mq5w-crxm-7xf5CGA-p7f6-6j2r-m4gcCGA-2697-34vq-x8m6CGA-2fc9-3wp3-vpmfCGA-2j9p-229x-353pCGA-2jjv-f9x3-w3fxCGA-2pw5-93hv-x2hqCGA-38rr-9rm6-9p2mCGA-3g9v-2q4m-67hqCGA-3gg5-35f7-gh6gCGA-3jcx-cx39-gqg5CGA-3mr8-fpxc-xq23CGA-3r7p-v6m2-w4p3CGA-4xf9-pw5f-vqcqCGA-4xmp-wc7p-r32rCGA-4xv8-v23g-4v6xCGA-5qhf-7hqp-gqc7CGA-5rp3-mqrj-pcjxCGA-67h5-hxx2-mxf6CGA-7m6j-wrpj-mcjhCGA-7q9v-2m24-x35qCGA-7rvf-75v2-2g3vCGA-85pc-8frp-58p2CGA-87qr-prxc-3294CGA-8xhw-9r42-rw6pCGA-9c25-23r3-h2g8CGA-9c9x-5p3c-3rhxCGA-c45f-x5wg-7gf8CGA-cc85-g4vp-3qw3CGA-cp2q-4cvq-g4jpCGA-cxqm-j78v-73w5CGA-f4mm-8459-x33hCGA-f4w7-mpgw-f9crCGA-fq6v-r5pm-22q8CGA-fw68-hqw3-24qjCGA-fxhr-946w-w69vCGA-g222-3x75-98mqCGA-ggjp-m57x-3646CGA-gw5r-96fc-c3jqCGA-h5fv-ph22-53r8CGA-h8m2-v2q8-3fc4CGA-hhjx-rrc2-42fwCGA-hpqh-g23r-28w6CGA-j3mx-rg4w-hghhCGA-j683-v74h-696xCGA-m525-gcmq-jphwCGA-m6hv-mhrg-qh3cCGA-mg3j-85vr-q57pCGA-mh6q-fq9g-hw7hCGA-p2jr-g8g9-4h9jCGA-q348-39vq-x4fcCGA-qhw9-g72f-rcw4CGA-qjfq-3fj7-38m7CGA-qp83-vhq6-8cvhCGA-qpgq-xm6q-6pxrCGA-r6x5-f76g-h3hqCGA-rf6w-8q52-whw6CGA-rg83-5h95-8v3hCGA-rpgx-8jrp-4f54CGA-rv57-fg88-98gqCGA-rv62-r7mg-rgj6CGA-v3rw-9x4h-hw48CGA-vcpc-q3fg-hfgqCGA-vh65-76qx-mqcfCGA-vp3m-m62f-j35pCGA-vpvv-23pc-98gwCGA-w55c-rrgm-wrmvCGA-x82h-hqc3-h448CGA-xc4m-m3vx-j562CGA-xc5p-v538-g67hCGA-xhwr-prp8-x9m4CGA-2523-2qpv-599mCGA-2qh4-jqv6-6jcrCGA-3j59-9j26-5p7pCGA-3r3g-5wj5-5qp8CGA-459c-437h-gcm3CGA-4ccm-pxhv-426xCGA-4f8r-wjgw-c6fgCGA-4g4x-jc55-8rr3CGA-5c4v-6rxp-f55xCGA-5f6q-f5fr-2765CGA-5xp3-gvw8-rwgjCGA-699j-q44h-8h3mCGA-6fx6-pm3r-q99fCGA-6gxq-9pc2-hv69CGA-724m-7jj8-8xm8CGA-75wx-fh9w-mr5vCGA-7656-45qp-2xfwCGA-76f5-x9rw-pxffCGA-77m3-5mr3-38vjCGA-77x4-7jv8-rfrjCGA-88mw-qgf8-3hqvCGA-8h55-635j-fvh8CGA-8rpx-86w4-xw2mCGA-97qh-7mv4-53m2CGA-98vp-jfxw-fq76CGA-9fcg-xh3q-r63pCGA-9v5p-j332-mq6xCGA-cr6c-r63w-62fvCGA-f6xh-9f9h-mrp8CGA-g6qp-5cgc-7j9cCGA-h53g-2hp2-m6fwCGA-hhg7-2xpf-ff57CGA-jjfx-xg5m-66rpCGA-jmj4-vfg5-wmjvCGA-m77w-422f-hfvjCGA-mxf9-97xf-hjvjCGA-mxqw-r54w-822pCGA-pcg7-wc6c-9qh4CGA-pjc9-vf8v-6rg7CGA-qm8r-2qq7-qh78CGA-qwp8-923h-8cp2CGA-r527-vfpx-wh89CGA-r8m8-3q42-v36pCGA-rc7c-mv57-vj75CGA-vcj5-725j-9rhcCGA-vpc3-cc5g-wqjcCGA-x2c5-2hv2-gcrwCGA-x67w-v6mj-2cw8CGA-xhhf-579h-4q35CGA-29wh-m9vg-h723CGA-2hv8-gxfx-4wgxCGA-2pcp-327j-2mchCGA-372f-vhrm-rchfCGA-389j-w7wg-gpm4CGA-3gq7-75gq-fpcqCGA-3j6r-gxv9-86vhCGA-3m2h-2crf-9v7gCGA-3xc9-v4q2-pxffCGA-427r-jv2g-2rpqCGA-4jvq-4p9p-8m9cCGA-4m3j-4cv6-456rCGA-4mq6-f395-9j6cCGA-576r-34p3-wfffCGA-5gc7-fr8f-58vjCGA-5grg-9mf3-xq6rCGA-5rg5-7m44-53qhCGA-6fr8-65p3-wqrjCGA-6m3x-x94q-h459CGA-72xp-72f8-c44fCGA-74pj-h63j-x2xjCGA-75g7-mmjc-jx9jCGA-7662-q782-jrpxCGA-7j92-443f-536hCGA-7m7w-mr88-55cvCGA-7m9j-vppv-cj98CGA-7q2x-6p8q-cfm2CGA-7rp8-5jwx-cpxvCGA-7vr2-vc38-5497CGA-8495-mm6v-hwmfCGA-89f2-736w-2mq6CGA-8fr7-fjh5-vf3pCGA-9237-p756-h5h2CGA-c82j-gc52-2pfwCGA-cqq8-8239-c542CGA-f4cr-qmch-2p69CGA-ffw7-7f27-7qp4CGA-fg24-jm7g-gvxjCGA-g2mg-xjv6-56qjCGA-g848-g5jm-5723CGA-ggm4-35c2-x8cvCGA-ggv2-hf26-vjr6CGA-gq7x-8876-vx74CGA-h47x-8cq3-622xCGA-h6h2-9wfx-q7q8CGA-hmv4-gjxx-g5xxCGA-hw5g-xccx-hg67CGA-j24q-vhcv-5949CGA-jfc3-6r66-77fpCGA-jjmj-cp3h-gcjjCGA-jmqv-2rr8-q9w9CGA-m7j4-pv7r-pfc9CGA-mchp-8xv3-2g87CGA-p3j5-mr4m-xp4pCGA-p59j-mqvv-v6f8CGA-pxc2-frj5-cx43CGA-qp48-x4hc-37rfCGA-qx66-q4fx-vx8fCGA-r338-53c5-gch7CGA-rcg8-vr2p-q7vfCGA-rf8q-fqw6-pmr5CGA-rjj2-4p54-396hCGA-rwh8-gx6p-j47jCGA-v22w-6j55-74hhCGA-v3hc-crq4-pcrfCGA-v858-5c26-2g6hCGA-vm2v-rw2j-qh8xCGA-vrm2-q756-78g4CGA-w7xw-9qgv-vhv5CGA-x336-mg7f-f44rCGA-xmwv-h75x-4vvcCGA-xpm4-g2q6-38vxCGA-28p5-qhgj-h9mxCGA-2j96-973w-wg7hCGA-3m4r-757v-grvcCGA-4fxm-xc29-rp8gCGA-4p98-95m5-c6j3CGA-57cf-xxxm-qcvxCGA-58rr-xgg6-f3h6CGA-597h-99mr-2cr9CGA-597v-vgj5-x8w6CGA-5q76-57mp-vq5cCGA-5xx5-7873-jpwhCGA-6274-p8x3-c5rqCGA-6m9q-r6w5-q586CGA-732c-cmgx-w744CGA-73mx-fffx-ww7vCGA-793p-pcm4-9f6mCGA-86wc-6g57-xj6pCGA-cfmw-wq56-992mCGA-cm95-cqjr-4gg8CGA-f2xx-g6wm-2hrcCGA-f623-8w7w-vhgwCGA-f9cp-583p-q4c4CGA-fh99-gh2c-cwwcCGA-fmf7-m6v8-2m88CGA-g8qx-r4gg-p8wpCGA-hf48-vwvq-8x22CGA-hqm9-hc8q-wxvmCGA-hr4m-mw3r-h4h2CGA-jg7x-68mf-gj9xCGA-jmch-2r63-m7prCGA-m5wg-62j3-cmv2CGA-mjv5-7cwj-pwffCGA-mrhx-w6p6-xccfCGA-mx59-pwq7-h9jmCGA-pg42-q55f-xfwcCGA-pvwf-5hhp-g2jcCGA-qhmp-crc3-w9gpCGA-qw63-2j42-xvrfCGA-r86p-cw39-mvfpCGA-rp99-h4c4-pgc2CGA-vvvw-8r9f-fxqgCGA-w57r-5v32-98f9CGA-w5gj-4cvf-758pCGA-wgmg-qcpf-q3gxCGA-xwrf-x2mp-5f6f
Advisory lineage Upstream: 0 Downstream: 25
Modified
Published: 30 Aug 2022, 05:05
Last modified:16 Sept 2024, 21:57

Vulnerability Summary

Overall Risk (default)
medium
41/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
2.75% LOW
3% probability +2.40%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

30 Aug 2022, 05:05
Published
Vulnerability first disclosed
16 Sept 2024, 21:57
Last Modified
Vulnerability information updated

Description

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 2.75%• Percentile: 86%

Techniques & Countermeasures

  • CWE-776•Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

    The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Affected Systems

  • chainguard•cassandra-5.0

    < 0

  • chainguard•cassandra-5.0-compat

    < 0

  • chainguard•cassandra-5.0-entrypoint-compat

    < 0

  • chainguard•cassandra-5.0-iamguarded-compat

    < 0

  • chainguard•cassandra-fips-5.0

    < 0

  • chainguard•cassandra-fips-5.0-compat

    < 0

  • chainguard•cqlsh-5.0

    < 0

  • chainguard•cqlsh-fips-5.0

    < 0

  • chainguard•eco-java-gradle-1.11

    all

  • chainguard•eco-java-gradle-2.0

    all

  • chainguard•eco-java-gradle-2.1

    all

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.2

    all

  • chainguard•eco-java-gradle-2.2.1

    all

  • chainguard•eco-java-gradle-2.3

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

Showing first 50 affected entries in server-rendered view.

References (17)