CVE-2022-28948
Aliases:GHSA-hp87-p4gw-j4gqGO-2022-0603SUSE-SU-2026:22997-1DEBIAN-CVE-2022-28948openSUSE-SU-2026:21457-1CGA-24pr-7v4g-75q6CGA-2h8j-jv4w-449vCGA-337p-q5p2-35qpCGA-3m32-47q5-m28jCGA-3wm4-2c82-vvqxCGA-4746-g8r9-7454CGA-4pp8-3vj7-77gcCGA-567f-g9px-7qg3CGA-5q2p-3399-qrwpCGA-6pqw-fr75-v96hCGA-6w8w-jv99-2g8rCGA-74v8-xfv2-3wv3CGA-7fmm-rgf2-f443CGA-8cv7-vx5r-qh64CGA-9485-xr78-36cxCGA-cfmq-ch7g-6gvwCGA-f5vr-24gp-f23mCGA-ff66-fr4x-mhg2CGA-gxrf-m34q-jqr9CGA-h872-qjv7-jrw5CGA-hqhp-8wf3-9pfqCGA-m27v-f25h-m3xvCGA-p3r9-g92v-vxj5CGA-pmfv-g2c5-5x52CGA-23vw-c5qp-6ghwCGA-24gv-mv38-4vccCGA-2pj2-v8rr-j357CGA-347m-f622-3c4mCGA-4w5m-2r77-4xhfCGA-6cjq-9q4c-hw74CGA-6fgr-3vv2-vwrcCGA-764m-qg3c-fmg4CGA-85w7-vc27-6696CGA-9275-wvrj-5phcCGA-f4m4-3hc9-xxm7CGA-fhfq-fq89-p9xgCGA-fhmw-3rr2-h36rCGA-fq26-989v-f5rmCGA-g2cw-97jr-5xfqCGA-g8m4-6hh5-gcqpCGA-gfgr-453v-hmfwCGA-h44j-ph4q-v358CGA-h98c-p32v-43hpCGA-hfg8-fq2v-hwcrCGA-jr86-c46r-6mvvCGA-mxpc-46x2-xfmgCGA-p3mj-hj65-fj2gCGA-pc7v-73mp-q2frCGA-pmqc-jf4f-cgw3CGA-q65r-gr4j-wh6hCGA-q949-5v35-c3cxCGA-qc9c-f6xv-xmpfCGA-qh2f-5rg7-3qjjCGA-qjcq-gp5f-cxxhCGA-qmx5-x94v-vwwpCGA-qrfm-33qh-3g37CGA-qrpr-r435-69rpCGA-r5vv-532c-qrcxCGA-rf58-pvcv-6526CGA-rw3h-89fv-jr7gCGA-v4c4-9wm2-c4fmCGA-v4vx-p69g-w664CGA-v8fv-972f-32rfCGA-vqqp-fwq4-g8f5CGA-w8w5-628g-wp25CGA-xhhj-8g54-g64jCGA-xp88-94vr-gjv6CGA-xrgv-j798-79xq
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 19 May 2022, 19:59
Last modified:03 Aug 2024, 06:10
Vulnerability Summary
Overall Risk (default)
medium
41/100 CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
3.96% LOW
4% probability +2.44%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
19 May 2022, 19:59
Published
Vulnerability first disclosed
03 Aug 2024, 06:10
Last Modified
Vulnerability information updated
Description
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS Trends
Current EPSS score: 3.96%• Percentile: 90%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•dynamic-localpv-provisioner
< 3.4.1-r3
- chainguard•dynamic-localpv-provisioner-fips
< 3.5.0-r0
- chainguard•kubeflow
< 0
- chainguard•kubeflow-access-management
< 0
- chainguard•kubeflow-access-management-compat
< 0
- chainguard•kubeflow-access-management-fips
< 1.10.0-r2
- chainguard•kubeflow-access-management-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook
< 0
- chainguard•kubeflow-admission-webhook-compat
< 0
- chainguard•kubeflow-admission-webhook-fips
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller
< 0
- chainguard•kubeflow-notebook-controller-compat
< 0
- chainguard•kubeflow-notebook-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-profile-controller
< 0
- chainguard•kubeflow-profile-controller-compat
< 0
- chainguard•kubeflow-profile-controller-fips
< 0
- chainguard•kubeflow-profile-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-pvcviewer-controller
< 0
- chainguard•kubeflow-pvcviewer-controller-compat
< 0
- chainguard•kubeflow-pvcviewer-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-pvcviewer-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-tensorboard-controller
< 0
- chainguard•kubeflow-tensorboard-controller-compat
< 0
- chainguard•kubeflow-tensorboard-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-tensorboard-controller-fips-compat
< 1.10.0-r2
- chainguard•nfs-subdir-external-provisioner
< 0
- chainguard•nfs-subdir-external-provisioner-fips
< 0
- chainguard•thanos-operator
< 0.3.7-r33
- chainguard•thanos-operator-compat
< 0.3.7-r33
- chainguard•thanos-operator-fips
< 0.3.7-r33
- chainguard•thanos-operator-fips-compat
< 0.3.7-r33
- wolfi•dynamic-localpv-provisioner
< 3.4.1-r3
- wolfi•kubeflow
< 0
- wolfi•kubeflow-access-management
< 0
- wolfi•kubeflow-access-management-compat
< 0
- wolfi•kubeflow-admission-webhook
< 0
- wolfi•kubeflow-admission-webhook-compat
< 0
- wolfi•kubeflow-notebook-controller
< 0
- wolfi•kubeflow-notebook-controller-compat
< 0
- wolfi•kubeflow-profile-controller
< 0
- wolfi•kubeflow-profile-controller-compat
< 0
- wolfi•kubeflow-pvcviewer-controller
< 0
- wolfi•kubeflow-pvcviewer-controller-compat
< 0
- wolfi•kubeflow-tensorboard-controller
< 0
- wolfi•kubeflow-tensorboard-controller-compat
< 0
- wolfi•nfs-subdir-external-provisioner
< 0
- wolfi•thanos-operator
< 0.3.7-r33
Showing first 50 affected entries in server-rendered view.
References (14)
- https://github.com/go-yaml/yaml/issues/666
- https://security.netapp.com/advisory/ntap-20220923-0006/
- https://nvd.nist.gov/vuln/detail/CVE-2022-28948
- https://github.com/go-yaml/yaml/issues/665
- https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf6754
- https://github.com/go-yaml/yaml/commit/f6f7691b1fdeb513f56608cd2c32c51f8194bf51
- https://github.com/go-yaml/yaml
- https://security.netapp.com/advisory/ntap-20220923-0006
- https://www.suse.com/support/update/announcement/2026/suse-su-202622997-1/
- https://bugzilla.suse.com/1237259
- https://bugzilla.suse.com/1248563
- https://bugzilla.suse.com/1267454
- https://www.suse.com/security/cve/CVE-2022-28948
- https://security-tracker.debian.org/tracker/CVE-2022-28948