Vulnerability · Published Dec 1, 2022 · Assigned by Google
CVE-2022-1471Remote Code execution in SnakeYAML
High 8.3
In plain English
A high-severity improper input validation in SnakeYAML from SnakeYAML. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 99.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | prometheus-jmx-exporter | 0.12.0-9.el8_7 | ALSA-2022:9058 |
| AlmaLinux:8 | prometheus-jmx-exporter-openjdk11 | 0.12.0-9.el8_7 | ALSA-2022:9058 |
| AlmaLinux:8 | prometheus-jmx-exporter-openjdk17 | 0.12.0-9.el8_7 | ALSA-2022:9058 |
| AlmaLinux:8 | prometheus-jmx-exporter-openjdk8 | 0.12.0-9.el8_7 | ALSA-2022:9058 |
| Debian:12 | snakeyaml | no fix listed | DEBIAN-CVE-2022-1471 |
| Debian:13 | snakeyaml | no fix listed | DEBIAN-CVE-2022-1471 |
| Debian:14 | snakeyaml | no fix listed | DEBIAN-CVE-2022-1471 |
| Maven | org.yaml:snakeyaml | 2.0 | GHSA-mjmj-j48q-9wg2 |
| Rocky Linux:8 | prometheus-jmx-exporter | 0:0.12.0-9.el8_7 | RLSA-2022:9058 |
| Ubuntu:22.04:LTS | snakeyaml | no fix listed | UBUNTU-CVE-2022-1471 |
| Ubuntu:24.04:LTS | snakeyaml | no fix listed | UBUNTU-CVE-2022-1471 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
References
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- https://github.com/mbechler/marshalsec
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://security.netapp.com/advisory/ntap-20230818-0015/
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html