[ https://issues.apache.org/jira/browse/OAK-9987?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Mohit Kataria resolved OAK-9987. -------------------------------- Fix Version/s: 1.46.0 Resolution: Fixed > Oak-search-elastic depends on vulnerable snakeyaml version. > ----------------------------------------------------------- > > Key: OAK-9987 > URL: https://issues.apache.org/jira/browse/OAK-9987 > Project: Jackrabbit Oak > Issue Type: Improvement > Components: indexing > Affects Versions: 1.44.0 > Reporter: Mohit Kataria > Assignee: Mohit Kataria > Priority: Major > Fix For: 1.46.0 > > > Description: oak-search-elastic embeds snakeyaml-1.26.jar which is vulnerable > to > CVE-2022-38749 MEDIUM Using snakeYAML to parse untrusted YAML files > may be vulnerable to Denial of Service attacks (DOS). If the parser is > running on user supplied input, an attacker may supply content that causes > the parser to crash by stackoverflow. > CVE-2022-38750 MEDIUM Using snakeYAML to parse untrusted YAML files > may be vulnerable to Denial of Service attacks (DOS). If the parser is > running on user supplied input, an attacker may supply content that causes > the parser to crash by stackoverflow. > CVE-2022-25857 MEDIUM The package org.yaml:snakeyaml from 0 and > before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested > depth limitation for collections. > CVE-2022-38751 MEDIUM Using snakeYAML to parse untrusted YAML files > may be vulnerable to Denial of Service attacks (DOS). If the parser is > running on user supplied input, an attacker may supply content that causes > the parser to crash by stackoverflow. > CVE-2022-38752 MEDIUM Using snakeYAML to parse untrusted YAML files > may be vulnerable to Denial of Service attacks (DOS). If the parser is > running on user supplied input, an attacker may supply content that causes > the parser to crash by stack-overflow. -- This message was sent by Atlassian Jira (v8.20.10#820010)