Medium ELSA-2022-6820 1 CVE

Moderate: prometheus-jmx-exporter security update (Oracle Linux 8)

Published Oct 6, 2022 · Updated Oct 6, 2022

Ecosystem: Oracle Linux

Summary

[0.12.0-8]
- Bump snakeyaml version to 1.32 to collect fix for CVE-2022-25857
(BZ 2128477)

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 8	prometheus-jmx-exporter	0:0.12.0-8.el8_6
Oracle Linux · 8	prometheus-jmx-exporter-openjdk11	0:0.12.0-8.el8_6

Vulnerabilities 1

High 7.5

CVE-2022-25857

Denial of Service (DoS)

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven

Aug 30, 2022