Debian/snakeyaml: critical 9.8
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recom
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: DEBIAN-CVE-2022-1471#Debian:13/snakeyaml
- https://security-tracker.debian.org/tracker/CVE-2022-1471
published · modified · JSON