ALAS2-2023-1976 — Important: snakeyaml security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-25857: The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Fixed packages 2

Release	Package	Fixed in
Amazon Linux · 2	snakeyaml	0:1.11-8.amzn2.0.1
Amazon Linux · 2	snakeyaml-javadoc	0:1.11-8.amzn2.0.1

Vulnerabilities 1

High 7.5

CVE-2022-25857

Denial of Service (DoS)

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven

Aug 30, 2022

References

web
https://alas.aws.amazon.com/cve/html/CVE-2022-25857.html