Red Hat OpenShift und Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service

Summary

Product

Vulnerabilities 6

• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• High 7.5
  CVE-2022-37734

  graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources

  graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.

  com.graphql-java:graphql-java Maven
  Sep 12, 2022
• Medium 6.5
  CVE-2022-38749

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Ubuntu Wolfi Maven
  Sep 5, 2022
• Medium 6.5
  CVE-2022-38750

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Ubuntu Wolfi Maven
  Sep 5, 2022
• Medium 6.5
  CVE-2022-38751

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Ubuntu Wolfi Maven
  Sep 5, 2022
• Medium 6.5
  CVE-2022-38752

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Wolfi Maven
  Sep 5, 2022

Revision history

1. 2025-04-27 #18

   Neue Updates von Red Hat aufgenommen

2. 2024-02-11 #17

   Neue Updates von Red Hat aufgenommen

3. 2024-01-09 #16

   Neue Updates von Amazon aufgenommen

4. 2023-12-21 #15

   Neue Updates von Dell aufgenommen

5. 2023-12-07 #14

   Neue Updates von Red Hat aufgenommen

6. 2023-06-15 #13

   Neue Updates von Red Hat aufgenommen

7. 2023-03-29 #12

   Neue Updates von Red Hat aufgenommen

8. 2023-03-01 #11

   Neue Updates von Red Hat aufgenommen

9. 2023-02-08 #10

   Neue Updates von Red Hat aufgenommen

10. 2023-01-22 #9

    Neue Updates von IBM aufgenommen

11. 2023-01-17 #8

    Neue Updates von Red Hat aufgenommen

12. 2022-12-14 #7

    Neue Updates von Red Hat aufgenommen

13. 2022-12-07 #6

    Neue Updates von Red Hat aufgenommen

14. 2022-11-28 #5

    Neue Updates von Red Hat aufgenommen

15. 2022-11-17 #4

    Neue Updates von Red Hat aufgenommen

16. 2022-10-26 #3

    Neue Updates von IBM aufgenommen

17. 2022-10-06 #2

    Neue Updates von Red Hat und Oracle Linux aufgenommen

18. 2022-10-05 #1

    Initiale Fassung

References

• Red Hat Security Advisory vom 2022-10-05
  https://access.redhat.com/errata/RHSA-2022:6757
• Red Hat Security Advisory vom 2022-10-05
  https://access.redhat.com/errata/RHSA-2022:6820
• Red Hat Security Advisory RHSA-2022:6835 vom 2022-10-06
  https://access.redhat.com/errata/RHSA-2022:6835
• Oracle Linux Security Advisory ELSA-2022-6820 vom 2022-10-07
  http://linux.oracle.com/errata/ELSA-2022-6820.html
• IBM Security Bulletin 6832094 vom 2022-10-27
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application-server-liberty-is-vulnerable-to-denial-of-service-due-to-graphql-java-cve-2022-37734/
• Red Hat Security Advisory RHSA-2022:8524 vom 2022-11-17
  https://access.redhat.com/errata/RHSA-2022:8524
• Red Hat Security Advisory RHSA-2022:8652 vom 2022-11-28
  https://access.redhat.com/errata/RHSA-2022:8652
• Red Hat Security Advisory RHSA-2022:8876 vom 2022-12-07
  https://access.redhat.com/errata/RHSA-2022:8876
• Red Hat Security Advisory RHSA-2022:9023 vom 2022-12-14
  https://access.redhat.com/errata/RHSA-2022:9023
• Red Hat Security Advisory RHSA-2023:0189 vom 2023-01-17
  https://access.redhat.com/errata/RHSA-2023:0189
• IBM Security Bulletin 6856687 vom 2023-01-20
  https://www.ibm.com/support/pages/node/6856687
• Red Hat Security Advisory RHSA-2023:0560 vom 2023-02-08
  https://access.redhat.com/errata/RHSA-2023:0560
• Red Hat Security Advisory RHSA-2023:1049 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1049
• Red Hat Security Advisory RHSA-2023:1043 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1043
• Red Hat Security Advisory RHSA-2023:1045 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1045
• Red Hat Security Advisory RHSA-2023:1047 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1047
• Red Hat Security Advisory RHSA-2023:1044 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1044
• Red Hat Security Advisory RHSA-2023:1513 vom 2023-03-30
  https://access.redhat.com/errata/RHSA-2023:1513
• Red Hat Security Advisory RHSA-2023:1514 vom 2023-03-30
  https://access.redhat.com/errata/RHSA-2023:1514
• Red Hat Security Advisory RHSA-2023:1512 vom 2023-03-30
  https://access.redhat.com/errata/RHSA-2023:1512
• Red Hat Security Advisory RHSA-2023:3641 vom 2023-06-15
  https://access.redhat.com/errata/RHSA-2023:3641
• Red Hat Security Advisory RHSA-2023:7697 vom 2023-12-07
  https://access.redhat.com/errata/RHSA-2023:7697
• Dell Security Advisory DSA-2023-300 vom 2023-12-22
  https://www.dell.com/support/kbdoc/000220649/dsa-2023-=
• Amazon Linux Security Advisory ALAS-2024-2403 vom 2024-01-10
  https://alas.aws.amazon.com/AL2/ALAS-2024-2403.html
• Red Hat Security Advisory RHSA-2024:0777 vom 2024-02-12
  https://access.redhat.com/errata/RHSA-2024:0777
• Red Hat Security Advisory RHSA-2024:0778 vom 2024-02-12
  https://access.redhat.com/errata/RHSA-2024:0778
• Red Hat Security Advisory RHSA-2024:0776 vom 2024-02-12
  https://access.redhat.com/errata/RHSA-2024:0776
• Red Hat Security Advisory RHSA-2025:4226 vom 2025-04-28
  https://access.redhat.com/errata/RHSA-2025:4226