Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | prometheus-jmx-exporter | 0:0.12.0-8.el8_6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | prometheus-jmx-exporter-openjdk11 | 0:0.12.0-8.el8_6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | prometheus-jmx-exporter-openjdk17 | 0:0.12.0-8.el8_6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | prometheus-jmx-exporter-openjdk8 | 0:0.12.0-8.el8_6 |
Vulnerabilities 1
-
High 7.5
Denial of Service (DoS)
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2126789
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6820.json
-
report
https://access.redhat.com/security/cve/CVE-2022-25857
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-25857
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25857
-
article
https://bitbucket.org/snakeyaml/snakeyaml/issues/525