SnakeYAML CVE-2022-1471 is fixed in 2.0 about security-research HOT 7 OPEN

Is the URL above accessible? The closest I could find that is accessible to me (thanks to a link in Blackduck KB) is a pull request 44,

https://bitbucket.org/snakeyaml/snakeyaml/pull-requests/44

The Google security advisory on SnakeYAML has few public details either (run.sh is not included). Only the project's tag 2.0 README and a Wiki page CVE & NIST imply that the CVEs against SnakeYAML are not exploitable unless the parser receives input from untrusted sources. The Google advisory is not clear as to where and why the Constructor class would be used. A SnakeYAML wiki page on CVE-2022-1471 ensures that the use of SnakeYAML in Spring was already safe and that many CVEs and tools ignore the exploit conditions, generating noisy alerts instead.

Was the (white-listing) fix breaking major contracts with the consumers of the library to deserve a new major version?

from security-research.

I've emailed the maintainer to ask to make the issue public again

from security-research.

@JLLeitschuh Does CVE-2022-1471 vulnerability apply if one uses SafeConstructor but with a SnakeYaml version of 1.33 or below?

from security-research.

From the maintainer regarding why that issue is not public currently:

Unfortunately, Bitbucket faces a spam attack for issue tracker. Many projects involved including SnakeYAML. I closed it because they recommended to close it temp-ly.
I hope to open it soon.
https://community.atlassian.com/t5/Bitbucket-questions/Spam-attack-on-issue-tracker/qaq-p/2299344#U2299607

from security-research.

@JLLeitschuh Does CVE-2022-1471 vulnerability apply if one uses SafeConstructor but with a SnakeYaml version of 1.33 or below?

If you are using SafeConstructor you are indeed safe.

from security-research.

@JLLeitschuh Thank you for confirming. Appreciate it.

from security-research.

The link works again now!

from security-research.