CVE-2022-28948: netapp astra_trident Deserialization of Untrusted Data
Modified
AliasesSUSE-SU-2025:02998-1SUSE-SU-2025:02999-1SUSE-SU-2025:03000-1SUSE-SU-2025:03001-1SUSE-SU-2026:22997-1UBUNTU-CVE-2022-28948DEBIAN-CVE-2022-28948CGA-24pr-7v4g-75q6CGA-2h8j-jv4w-449vCGA-337p-q5p2-35qpCGA-3m32-47q5-m28jCGA-3wm4-2c82-vvqxCGA-4746-g8r9-7454CGA-4pp8-3vj7-77gcCGA-567f-g9px-7qg3CGA-5q2p-3399-qrwpCGA-6pqw-fr75-v96hCGA-6w8w-jv99-2g8rCGA-74v8-xfv2-3wv3CGA-7fmm-rgf2-f443CGA-8cv7-vx5r-qh64CGA-9485-xr78-36cxCGA-cfmq-ch7g-6gvwCGA-f5vr-24gp-f23mCGA-ff66-fr4x-mhg2CGA-gxrf-m34q-jqr9CGA-h872-qjv7-jrw5CGA-hqhp-8wf3-9pfqCGA-m27v-f25h-m3xvCGA-p3r9-g92v-vxj5CGA-pmfv-g2c5-5x52CGA-qc9c-f6xv-xmpfCGA-qjcq-gp5f-cxxhCGA-qmx5-x94v-vwwpCGA-qrfm-33qh-3g37CGA-qrpr-r435-69rpCGA-r5vv-532c-qrcxCGA-rf58-pvcv-6526CGA-rw3h-89fv-jr7gCGA-v4vx-p69g-w664CGA-vqqp-fwq4-g8f5GHSA-hp87-p4gw-j4gqGO-2022-0603openSUSE-SU-2025:15510-1openSUSE-SU-2026:21457-1CGA-23vw-c5qp-6ghwCGA-24gv-mv38-4vccCGA-2pj2-v8rr-j357CGA-347m-f622-3c4mCGA-4w5m-2r77-4xhfCGA-6cjq-9q4c-hw74CGA-6fgr-3vv2-vwrcCGA-764m-qg3c-fmg4CGA-85w7-vc27-6696CGA-9275-wvrj-5phcCGA-f4m4-3hc9-xxm7CGA-fhfq-fq89-p9xgCGA-fhmw-3rr2-h36rCGA-fq26-989v-f5rmCGA-g2cw-97jr-5xfqCGA-g8m4-6hh5-gcqpCGA-gfgr-453v-hmfwCGA-h44j-ph4q-v358CGA-h98c-p32v-43hpCGA-hfg8-fq2v-hwcrCGA-jr86-c46r-6mvvCGA-mxpc-46x2-xfmgCGA-p3mj-hj65-fj2gCGA-pc7v-73mp-q2frCGA-pmqc-jf4f-cgw3CGA-q65r-gr4j-wh6hCGA-q949-5v35-c3cxCGA-qh2f-5rg7-3qjjCGA-v4c4-9wm2-c4fmCGA-v8fv-972f-32rfCGA-w8w5-628g-wp25CGA-xhhj-8g54-g64jCGA-xp88-94vr-gjv6CGA-xrgv-j798-79xqALPINE-CVE-2022-28948
Published 19-05-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-28948 is a high (CVSS 7.5) Deserialization of Untrusted Data vulnerability in netapp astra_trident. EPSS estimates a 3.96% chance of exploitation in the next 30 days, higher than 90.4% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Prioritisepublic exploit
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
3.96%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 4 · Related 13Timeline
- 19-05-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
CVSS metrics
8 scores · 7 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
3.96%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.96% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundYaml
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard34 products
- dynamic-localpv-provisioner< 3.4.1-r3
- dynamic-localpv-provisioner-fips< 3.5.0-r0
- kubeflowAll versions (No fix recorded)
- kubeflow-access-managementAll versions (No fix recorded)
- kubeflow-access-management-compatAll versions (No fix recorded)
Wolfi17 products
- dynamic-localpv-provisioner< 3.4.1-r3
- kubeflowAll versions (No fix recorded)
- kubeflow-access-managementAll versions (No fix recorded)
- kubeflow-access-management-compatAll versions (No fix recorded)
- kubeflow-admission-webhookAll versions (No fix recorded)
Suse6 products
- hawk-apiserver&distro=SUSE Linux Enterprise High Availability Extension 16.0< 0.1.0+git.1781014483.1c464f2-160000.1.1
- ignition&distro=SUSE Linux Enterprise Micro 5.1< 2.14.0-150300.4.16.1
- ignition&distro=SUSE Linux Enterprise Micro 5.2< 2.14.0-150300.6.16.1
- ignition&distro=SUSE Linux Enterprise Micro 5.3< 2.14.0-150400.4.12.1
- ignition&distro=SUSE Linux Enterprise Module for HPC 15 SP6< 2.14.0-150400.9.12.1
Opensuse3 products
- hawk-apiserver&distro=openSUSE Leap 16.0< 0.1.0+git.1781014483.1c464f2-160000.1.1
- ignition&distro=openSUSE Leap 15.6< 2.14.0-150400.9.12.1
- traefik2&distro=openSUSE Tumbleweed< 2.11.29-1.1
Ubuntu2 products
- golang-gopkg-yaml.v3All versions (No fix recorded)
- snapdAll versions (No fix recorded) | < 2.63+20.04ubuntu0.1 | < 2.63+22.04ubuntu0.1 | < 2.62+24.04build1
Alpine1 product
- coredns< 1.9.3-r0
Debian1 product
- golang-gopkg-yaml.v3< 3.0.1-1
Gopkg.in1 product
- yaml.v3< 3.0.1 | < 3.0.0-20220521103104-8f96da9f5d5e
Netapp1 product
Yaml_project1 product
- yaml3.0.0
10 vendors · 67 products
References
25 links- github.com/go-yaml/yaml/issues/666X Refsource MISCREPORTWEBExploitIssue TrackingPatchThird Party Advisory
Show all 25 references
- github.com/go-yaml/yamlPACKAGE