Resource exhaustion in Snakeyaml - CVE-2022-25857

Vulnerability identifier: #VU67665

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-25857

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling YAML files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Snakeyaml
IBM Cloud Pak for Watson AIOps
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
IBM Watson Machine Learning Accelerator
Guardium Data Security Center (GDSC)
IBM Business Automation Manager Open Editions
Integration Designer
Db2 Graph
IBM i Modernization Engine for Lifecycle Integration
IBM Planning Analytics Workspace
PowerStore X
PowerStore T
WebSphere Service Registry and Repository
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
Dell Secure Connect Gateway
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Exposure Function
Netcool Operations Insight
Red Hat Integration - Service Registry
IBM Cloud Pak for Multicloud Management Monitoring
Red Hat build of Quarkus
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Sterling Partner Engagement Manager
Red Hat Satellite
IBM Spectrum Symphony
IBM Maximo Application Suite
IBM MQ
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
AMQ Clients
eap7-wildfly-http-client (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-netty-tcnative (Red Hat package)
eap7-undertow (Red Hat package)
eap7-glassfish-jsf (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-jboss-vfs (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libyaml-snake-java (Ubuntu package)
prometheus-jmx-exporter-openjdk11
prometheus-jmx-exporter
prometheus-jmx-exporter (Red Hat package)
cri-o (Red Hat package)
snakeyaml-javadoc
snakeyaml
eap7-undertow-jastow (Red Hat package)
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)
rh-sso7-keycloak (Red Hat package)
IBM Data Risk Manager
IBM Cloud Pak System
Vert.x
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Fedora
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Oracle Linux
Ubuntu
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Development Tools
openSUSE Leap
openEuler
Red Hat OpenShift Container Platform
IBM Disconnected Log Collector
OpenShift Developer Tools and Services
IBM App Connect Enterprise
Red Hat Camel for Spring Boot
SecureTransport
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
JBoss Enterprise Application Platform
AMQ Broker
Fuse
Red Hat Single Sign-On
JBoss Data Grid
PeopleSoft Enterprise PeopleTools
JD Edwards EnterpriseOne Orchestrator
Oracle Communications Billing and Revenue Management
Voice Gateway
Oracle Communications Pricing Design Center
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
watsonx.data
IBM DB2
IBM InfoSphere Information Server

Install updates from vendor's website.

Snakeyaml - update to 1.31
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.13-1.SP1_redhat_00001.1.el7eap, 1.1.13-1.SP1_redhat_00001.1.el8eap, 1.1.13-1.SP1_redhat_00001.1.el9eap
Log Analysis - update to 1.3.7.2 IF003
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.3-3.SP2_redhat_00001.1.el7eap, 1.5.3-3.SP2_redhat_00001.1.el8eap, 1.5.3-3.SP2_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-20.Final_redhat_00019.1.el7eap, 1.10.0-20.Final_redhat_00019.1.el8eap, 1.10.0-20.Final_redhat_00019.1.el9eap
IBM Process Mining - update to 1.13.1
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.14-1.Final_redhat_00001.1.el7eap, 1.15.14-1.Final_redhat_00001.1.el8eap, 1.15.14-1.Final_redhat_00001.1.el9eap
eap7-snakeyaml (Red Hat package) - addressed in versions 1.31.0-1.redhat_00001.1.el7eap, 1.31.0-1.redhat_00001.1.el8eap, 1.31.0-1.redhat_00001.1.el9eap
IBM Cloud Transformation Advisor - update to 3.4.0
IBM Data Risk Manager - update to 2.0.6.15
eap7-netty-tcnative (Red Hat package) - addressed in versions 2.0.52-3.Final_redhat_00001.1.el7eap, 2.0.52-3.Final_redhat_00001.1.el8eap, 2.0.52-3.Final_redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.19-1.SP2_redhat_00001.1.el7eap, 2.2.19-1.SP2_redhat_00001.1.el8eap, 2.2.19-1.SP2_redhat_00001.1.el9eap
IBM Cloud Pak System - update to 2.3.3.6
eap7-glassfish-jsf (Red Hat package) - addressed in versions 2.3.14-5.SP06_redhat_00001.1.el7eap, 2.3.14-5.SP06_redhat_00001.1.el8eap, 2.3.14-5.SP06_redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-10.redhat_00045.1.el7eap, 2.16.0-10.redhat_00045.1.el8eap, 2.16.0-10.redhat_00045.1.el9eap
eap7-jboss-vfs (Red Hat package) - addressed in versions 3.2.17-1.Final_redhat_00001.1.el7eap, 3.2.17-1.Final_redhat_00001.1.el8eap, 3.2.17-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.14-1.Final_redhat_00001.1.el7eap, 3.3.14-1.Final_redhat_00001.1.el8eap, 3.3.14-1.Final_redhat_00001.1.el9eap
Guardium Data Security Center (GDSC) - update to 3.6.1
eap7-resteasy (Red Hat package) - addressed in versions 3.15.4-1.Final_redhat_00001.1.el7eap, 3.15.4-1.Final_redhat_00001.1.el8eap, 3.15.4-1.Final_redhat_00001.1.el9eap
Vert.x - update to 4.3.3
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.45-1.Final_redhat_00001.1.el7eap, 4.0.45-1.Final_redhat_00001.1.el8eap, 4.0.45-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.77-3.Final_redhat_00001.1.el7eap, 4.1.77-3.Final_redhat_00001.1.el8eap, 4.1.77-3.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.77-3.Final_redhat_00001.1.el7eap, 4.1.77-3.Final_redhat_00001.1.el8eap, 4.1.77-3.Final_redhat_00001.1.el9eap
Red Hat OpenShift Container Platform - addressed in versions 4.9.56, 4.10.51
Dell Secure Connect Gateway - update to 5.14.00.10
eap7-hibernate (Red Hat package) - addressed in versions 5.3.28-1.Final_redhat_00001.1.el7eap, 5.3.28-1.Final_redhat_00001.1.el8eap, 5.3.28-1.Final_redhat_00001.1.el9eap
SecureTransport - update to 5.5-20220929
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.4
JBoss Enterprise Application Platform - update to 7.4.7
eap7-wildfly (Red Hat package) - addressed in versions 7.4.7-3.GA_redhat_00003.1.el7eap, 7.4.7-3.GA_redhat_00003.1.el8eap, 7.4.7-3.GA_redhat_00003.1.el9eap
Red Hat Single Sign-On - update to 7.6.2
AMQ Broker - update to 7.10.2
Fuse - update to 7.11.1
IBM Business Automation Manager Open Editions - update to 8.0.3
JBoss Data Grid - update to 8.4.0
JD Edwards EnterpriseOne Orchestrator - update to 9.2.7.3
libyaml-snake-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.23-1+deb10u1build0.18.04.1, 1.25+ds-2ubuntu0.1, 1.29-1ubuntu0.22.04.1, 1.29-1ubuntu0.22.10.1
prometheus-jmx-exporter-openjdk11 - update to 0.12.0-8
prometheus-jmx-exporter - update to 0.12.0-8
prometheus-jmx-exporter (Red Hat package) - update to 0.12.0-8.el8_6
Db2 Graph - addressed in versions 1.0.0.1562-amd64, 1.0.0.1562-s390x, 1.0.0.1562-ppcle, 1.0.0.1598-amd64, 1.0.0.1598-s390x, 1.0.0.1598-ppcle
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
IBM i Modernization Engine for Lifecycle Integration - update to 1.4
Netcool Operations Insight - update to 1.6.10
IBM Disconnected Log Collector - update to 1.8.3
cri-o (Red Hat package) - addressed in versions 1.23.5-5.rhaos4.10.gitd9dec98.el7, 1.23.5-5.rhaos4.10.gitd9dec98.el8
snakeyaml-javadoc - update to 1.31-150200.3.8.1
snakeyaml - addressed in versions 1.31-150200.3.8.1, 1.31-150200.12.6.1
snakeyaml - update to 1.32-1
snakeyaml-javadoc - update to 1.32-1
snakeyaml - addressed in versions 1.32-1.el8, 1.32-1.el9
watsonx.data - update to 2.0
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.11-1.Final_redhat_00001.1.el7eap, 2.0.11-1.Final_redhat_00001.1.el8eap, 2.0.11-1.Final_redhat_00001.1.el9eap
IBM Planning Analytics Workspace - update to 2.0.83
Red Hat Integration - Service Registry - update to 2.3.0
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 6
Red Hat build of Quarkus - update to 2.7.6.SP1
jenkins (Red Hat package) - addressed in versions 2.361.1.1675668150-1.el8, 2.387.1.1683009763-3.el8, 2.414.3.1698292201-3.el8, 2.414.3.1698293911-3.el8, 2.426.3.1706515686-3.el8, 2.426.3.1706516254-3.el8, 2.426.3.1706516352-3.el8
PowerStore X - update to 3.2.1.0-1989710
PowerStore T - update to 3.2.1.0-1989710
Red Hat Camel for Spring Boot - addressed in versions 3.18.3 Patch 2, 3.20.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
jenkins-2-plugins (Red Hat package) - addressed in versions 4.9.1675668922-1.el8, 4.10.1675144701-1.el8, 4.11.1683009941-1.el8, 4.12.1698294000-1.el8, 4.12.1706515741-1.el8, 4.13.1698292274-1.el8, 4.13.1706516346-1.el8, 4.14.1706516441-1.el8
IBM Sterling B2B Integrator - addressed in versions 6.0.3.8, 6.1.2.1
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.10, 6.2.2.2
Red Hat Satellite - update to 6.13
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
IBM MQ - addressed in versions 9.2.0.7, 9.3.0.2, 9.3.1.0
IBM DB2 - update to 11.1.4.7
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
IBM Business Automation Workflow - addressed in versions 20.0.0.2, 21.0.3, 21.0.3 IF015, 22.0.1, 22.0.1 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.18, 22.0.2.2
AMQ Clients - update to 2023.Q4

• https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174
• https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174
• https://bitbucket.org/snakeyaml/snakeyaml/issues/525

• Multiple vulnerabilities in Snakeyaml
• SUSE update for snakeyaml
• Multiple vulnerabilities in Red Hat build of Eclipse Vert.x
• Multiple DoS vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple DoS vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Red Hat Enterprise Linux 8 update for prometheus-jmx-exporter
• Multiple vulnerabilities in Red Hat Integration - Service registry
• Resource exhaustion in IBM Process Mining
• SUSE update for snakeyaml
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Resource exhaustion in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Linux
• Red Hat build of Quarkus update for Snakeyaml
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Red Hat Data Grid
• IBM Log Analysis update for SnakeYAML
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in Red Hat AMQ Broker 7.10
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Voice Gateway
• Resource exhaustion in IBM MQ Blockchain bridge
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Ubuntu update for snakeyaml
• Multiple vulnerabilities in Axway SecureTransport (September 2022)
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Multiple vulnerabilities in Red Hat Satellite 6.13
• Multiple vulnerabilities in IBM Db2 Graph
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• OpenShift Developer Tools and Services for OCP 4.11 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• OpenShift Developer Tools and Services for OCP 4.13 update for jenkins and jenkins-2-plugins
• Red Hat Product OCP Tools 4.12 update for Openshift Jenkins
• Multiple vulnerabilities in Red Hat AMQ Clients
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in Netcool Operations Insight
• OpenShift Developer Tools and Services for OCP 4.13 update for jenkins and jenkins-2-plugins
• OpenShift Developer Tools and Services for OCP 4.14 update for jenkins and jenkins-2-plugins
• OpenShift Developer Tools and Services for OCP 4.12 update for Jenkins and Jenkins-2-plugins
• openEuler 22.03 LTS update for snakeyaml
• openEuler 22.03 LTS SP1 update for snakeyaml
• openEuler 20.03 LTS SP1 update for snakeyaml
• openEuler 20.03 LTS SP3 update for snakeyaml
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• Multiple vulnerabilities in IBM Integration Designer
• IBM Sterling Partner Engagement Manager Essentials Edition update for Java package org.yaml:snakeyam
• Fedora EPEL 8 update for snakeyaml
• Fedora EPEL 9 update for snakeyaml
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in IBM watsonx.data
• Anolis OS update for prometheus-jmx-exporter