Description
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
Remediation
References
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081
https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
https://security.gentoo.org/glsa/202305-28
https://security.netapp.com/advisory/ntap-20240315-0009/
Related Vulnerabilities
CVE-2017-16075 Vulnerability in npm package http-proxy.js
CVE-2023-30331 Vulnerability in maven package com.ibeetl:beetl
CVE-2021-27905 Vulnerability in maven package org.apache.solr:solr-core
CVE-2022-28820 Vulnerability in maven package com.adobe.acs:acs-aem-commons-ui.apps
CVE-2019-10427 Vulnerability in maven package org.jenkins-ci.plugins:aqua-microscanner