An update that solves one vulnerability and has one errata is now available.. openSUSE Security Update: Security update for snakeyaml =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F Announcement ID: openSUSE-SU-2021:0855-1 Rating: important References: #1159488 #1186088 Cross-References: CVE-2017-18640 CVSS scores: CVE-2017-18640 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N= /S:U/C:N/I:N/A:H CVE-2017-18640 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N= /S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F An update that solves one vulnerability and has one errata is now available. Description: This update for snakeyaml fixes the following issues: - Upgrade to 1.28 - CVE-2017-18640: The Alias feature allows entity expansion during a loa= d operation (bsc#1159488, bsc#1186088) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended instal= lation methods like YaST online=5Fupdate or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-855=3D1 Package List: - openSUSE Leap 15.2 (noarch): snakeyaml-1.28-lp152.2.3.1 snakeyaml-javadoc-1.28-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2017-18640.html https://bugzilla.suse.com/1159488 https://bugzilla.suse.com/1186088 . A significant enhancement for Snakeyaml has been rolled outon openSUSE, addressing a severe vulnerability that permits entity expansion during data loading processes.. openSUSE security update, snakeyaml entity expansion, security advisory important, CVE-2017-18640, software update. . Severity: Important. LinuxSecurity.com Team
SnakeYAML could be made to crash if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-7368-1 March 27, 2025 snakeyaml vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: SnakeYAML could be made to crash if it received specially crafted input. Software Description: - snakeyaml: YAML parser and emitter for the Java programming language Details: It was discovered that SnakeYAML incorrectly handled recursive entity references. An attacker could possibly use this issue to cause SnakeYAML to crash, resulting in a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS libyaml-snake-java 1.25+ds-2ubuntu0.1+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libyaml-snake-java 1.23-1+deb10u1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libyaml-snake-java 1.12-2ubuntu0.16.04.1~esm2 Available with Ubuntu Pro Ubuntu 14.04 LTS libyaml-snake-java 1.12-2ubuntu0.14.04.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7368-1 CVE-2017-18640 . Update on Ubuntu's security advisory USN-7368-1 addressing SnakeYAML's potential to crash under crafted input.. snakeyaml, crash, received,specially, crafted, input, ===========================. . Severity: Critical. LinuxSecurity.com Team
* bsc#1205628 Cross-References: * CVE-2022-4065 . # Security update for mockito, snakeyaml, testng Announcement ID: SUSE-SU-2024:2568-1 Rating: important References: * bsc#1205628 Cross-References: * CVE-2022-4065 CVSS scores: * CVE-2022-4065 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2022-4065 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2022-4065 ( NVD ): 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Affected Products: * Development Tools Module 15-SP5 * Development Tools Module 15-SP6 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Server 4.3 * SUSE Manager Server 4.3 Module 4.3 * SUSE Package Hub 15 15-SP6 An update that solves one vulnerability can now be installed. ## Description: This update for mockito, snakeyaml, testng fixes the following issues: mockito was updated to version 5.11.0: * Added bundle manifest to the mockito-core artifact * Mockito 5 is making core changes to ensure compatibility with future JDK versions. * Switch the Default MockMaker to mockito-inline (not applicable to mockito- android) * Mockito 2.7.6 introduced the mockito-inline mockmaker based on the "inline bytecode" principle, offering compatibility advantages over the subclass mockmaker * This change avoids JDK restrictions, such as violating module boundaries and leaking subclass creation * Legitimate use cases for the subclass mockmaker: * Scenarios where the inline mockmaker does not function, such as on Graal VM's native image * If avoiding mocking final classes, the subclass mockmaker remains a viable option, although issues may arise on JDK 17+ * Mockito aims to support both mockmakers, allowing users to choose based on their requirements. * Update the Minimum Supported Java Version to 11 * Mockito 5 raised the minimum supported Java version to 11 * Community member @reta contributed to this change. * Users still on JDK 8 can continue using Mockito 4, with minimal API differences between versions * New type() Method on ArgumentMatcher * The ArgumentMatcher interface now includes a new type() method to support varargs methods, addressing previous limitations * Users can now differentiate between matching calls with any exact number of arguments or match any number of arguments * Mockito 5 provides a default implementation of the new method, ensuring backward compatibility. * No obligation for users to implement the new method; Mockito 5 considers Void.type by default for varargs handling * ArgumentCaptor is now fullytype-aware, enabling capturing specific subclasses on a generic method. * byte-buddy does not bundle asm, but uses objectweb-asm as external library snake-yaml was updated to version 2.2: * Changes of version 2.2: * Define default scalar style as PLAIN (for polyglot Maven) * Add missing 'exports org.yaml.snakeyaml.inspector' to module-info.java * Changes of version 2.1: * Heavy Allocation in Emitter.analyzeScalar(String) due to Regex Overhead * Use identity in toString() for sequences to avoid OutOfMemoryError * NumberFormatException from SnakeYAML due to int overflow for corrupt YAML version * Document size limit should be applied to single document notthe whole input stream * Detect invalid Unicode code point (thanks to Tatu Saloranta) * Remove Trusted*Inspector classes from main sources tree * Changes of version 2.0: * Rollback to Java 7 target * Add module-info.java * Migrate to Java 8 * Remove many deprecated constructors * Remove long deprecated methods in FlowStyle * Do not allow global tags by default * Yaml.LoadAs() signature to support Class
Change for system JDK from 17 to 21. upstream security release 122.0.6261.94 High CVE-2024-1938: Type Confusion in V8 High CVE-2024-1939: Type Confusion in V8 fixed bug with requires. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-129d8ca6fc 2024-03-07 22:24:39.963937 -------------------------------------------------------------------------------- Name : snakeyaml Product : Fedora 40 Version : 1.33 Release : 3.fc40 URL : https://bitbucket.org/snakeyaml/snakeyaml Summary : YAML parser and emitter for Java Description : SnakeYAML features: * a complete YAML 1.1 parser. In particular, SnakeYAML can parse all examples from the specification. * Unicode support including UTF-8/UTF-16 input/output. * high-level API for serializing and deserializing native Java objects. * support for all types from the YAML types repository. * relatively sensible error messages. -------------------------------------------------------------------------------- Update Information: Change for system JDK from 17 to 21. upstream security release 122.0.6261.94 High CVE-2024-1938: Type Confusion in V8 High CVE-2024-1939: Type Confusion in V8 fixed bug with requires Automatic update for lucene-9.9.2-1.fc40. bump java source/target to 1.8, fixes 2266639 -------------------------------------------------------------------------------- ChangeLog: * Sat Mar 2 2024 Jiri Vanek - 1.33-3 - Rebuilt for java-21-openjdk as system jdk -------------------------------------------------------------------------------- References: [ 1 ] Bug #2123726 - consoleImageViewer crashes at start https://bugzilla.redhat.com/show_bug.cgi?id=2123726 [ 2 ] Bug #2261062 - directory-maven-plugin: FTBFS in Fedora rawhide/f40 https://bugzilla.redhat.com/show_bug.cgi?id=2261062 [ 3 ] Bug #2266639 - directory-maven-plugin fails to build with java-21-openjdk https://bugzilla.redhat.com/show_bug.cgi?id=2266639 [ 4 ] Bug #2266934 - CVE-2024-1938 chromium: type confusion [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2266934 [ 5 ] Bug #2266937 - CVE-2024-1939 chromium: type confusion [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2266937 [ 6 ] Bug #2267486 - Include Java 21 as system Java Change in Fedora 40 Beta https://bugzilla.redhat.com/show_bug.cgi?id=2267486 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-129d8ca6fc' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Multiple vulnerabilities have been found in snakeyaml, the worst of which could result in denial of service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202305-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: snakeyaml: Multiple Vulnerabilities Date: May 21, 2023 Bugs: #776796, #868621 ID: 202305-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in snakeyaml, the worst of which could result in denial of service. Background ========= snakeyaml is a YAML 1.1 parser and emitter for Java. Affected packages ================ Package Vulnerable Unaffected ------------------ ------------ ------------ dev-java/snakeyaml < 1.33 > = 1.33 Description ========== Multiple vulnerabilities have been discovered in snakeyaml. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All snakeyaml users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-java/snakeyaml-1.33" References ========= [ 1 ] CVE-2017-18640 https://nvd.nist.gov/vuln/detail/CVE-2017-18640 [ 2 ] CVE-2022-38749 https://nvd.nist.gov/vuln/detail/CVE-2022-38749 [ 3 ] CVE-2022-38750 https://nvd.nist.gov/vuln/detail/CVE-2022-38750 [ 4 ] CVE-2022-38751 https://nvd.nist.gov/vuln/detail/CVE-2022-38751 [ 5 ] CVE-2022-38752 https://nvd.nist.gov/vuln/detail/CVE-2022-38752 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202305-28 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Security fix for CVE-2022-41854. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-c01dd659fa 2022-12-21 01:27:49.869566 --------------------------------------------------------------------------------Name : snakeyaml Product : Fedora 37 Version : 1.32 Release : 1.fc37 URL : https://bitbucket.org/snakeyaml/snakeyaml Summary : YAML parser and emitter for Java Description : SnakeYAML features: * a complete YAML 1.1 parser. In particular, SnakeYAML can parse all examples from the specification. * Unicode support including UTF-8/UTF-16 input/output. * high-level API for serializing and deserializing native Java objects. * support for all types from the YAML types repository. * relatively sensible error messages. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2022-41854 --------------------------------------------------------------------------------ChangeLog: * Fri Sep 16 2022 Severin Gehwolf - 1.32-1 - Update to latest upstream 1.32 release - Resolves: CVE-2022-25857 --------------------------------------------------------------------------------References: [ 1 ] Bug #2151988 - CVE-2022-41854 dev-java/snakeyaml: DoS via stack overflow https://bugzilla.redhat.com/show_bug.cgi?id=2151988 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-c01dd659fa' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Security fix for CVE-2022-41854. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-8a4e8aa190 2022-12-21 01:17:10.825463 --------------------------------------------------------------------------------Name : snakeyaml Product : Fedora 36 Version : 1.32 Release : 1.fc36 URL : https://bitbucket.org/snakeyaml/snakeyaml Summary : YAML parser and emitter for Java Description : SnakeYAML features: * a complete YAML 1.1 parser. In particular, SnakeYAML can parse all examples from the specification. * Unicode support including UTF-8/UTF-16 input/output. * high-level API for serializing and deserializing native Java objects. * support for all types from the YAML types repository. * relatively sensible error messages. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2022-41854 --------------------------------------------------------------------------------ChangeLog: * Mon Dec 12 2022 Severin Gehwolf - 1.32-1 - Update to latest upstream 1.32 release - Resolves: CVE-2022-25857, CVE-2022-41854 --------------------------------------------------------------------------------References: [ 1 ] Bug #2151988 - CVE-2022-41854 dev-java/snakeyaml: DoS via stack overflow https://bugzilla.redhat.com/show_bug.cgi?id=2151988 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-8a4e8aa190' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
An update that fixes 6 vulnerabilities is now available. . SUSE Security Update: Security update for snakeyaml ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3560-1 Rating: important References: #1183360 #1202932 #1203149 #1203153 #1203154 #1203158 Cross-References: CVE-2020-13936 CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 CVSS scores: CVE-2020-13936 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-13936 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25857 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-25857 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38749 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-38749 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38750 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-38750 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38751 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-38751 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38752 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-38752 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 SUSE Manager Server 4.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for snakeyaml fixes the following issues: snakeyaml was upgraded to version 1.31: -CVE-2022-25857: Fixed DoS due missing to nested depth limitation for collections (bsc#1202932). - CVE-2022-38749: Fixed DoS due to stack overflow in parser (bsc#1202932). - CVE-2022-38751: Fixed DoS due to parsing of untrusted yaml files (bsc#1203153). - CVE-2022-38752: Fixed DoS due to stack overflow in parser (bsc#1203154). - CVE-2022-38750: Fixed DoS due to parsing of untrusted yaml files (bsc#1203158). - CVE-2020-13936: Fixed arbitrary code execution when attacker is able to modify templates (bsc#1183360). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3560=1 Package List: - SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (noarch): snakeyaml-1.31-150200.12.6.1 References: https://www.suse.com/security/cve/CVE-2020-13936.html https://www.suse.com/security/cve/CVE-2022-25857.html https://www.suse.com/security/cve/CVE-2022-38749.html https://www.suse.com/security/cve/CVE-2022-38750.html https://www.suse.com/security/cve/CVE-2022-38751.html https://www.suse.com/security/cve/CVE-2022-38752.html https://bugzilla.suse.com/1183360 https://bugzilla.suse.com/1202932 https://bugzilla.suse.com/1203149 https://bugzilla.suse.com/1203153 https://bugzilla.suse.com/1203154 https://bugzilla.suse.com/1203158 . A major SUSE update has been issued to fix critical security flaws in SnakeYAML, including risks of DoS attacks and remote code execution, enhancing security.. SUSE Update,SUSE Security Update,SUSE Manager Security,snakeyaml Fix. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.