SnakeYAML CVE-2022-1471 is fixed in 2.0

[JLLeitschuh]

Hey @rcorrea35

I spent a ton of time working with this maintainer and they finally fixed the security vulnerability in version 2.0

Please review the following issue:
https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in

Please update your advisory, and the CVE to reflect this! 😃

[ilatypov]

Is the URL above accessible? The closest I could find that is accessible to me (thanks to a link in Blackduck KB) is a pull request 44,

https://bitbucket.org/snakeyaml/snakeyaml/pull-requests/44

The Google security advisory on SnakeYAML has few public details either (run.sh is not included). Only the project's tag 2.0 README and a Wiki page CVE & NIST imply that the CVEs against SnakeYAML are not exploitable unless the parser receives input from untrusted sources. The Google advisory is not clear as to where and why the Constructor class would be used. A SnakeYAML wiki page on CVE-2022-1471 ensures that the use of SnakeYAML in Spring was already safe and that many CVEs and tools ignore the exploit conditions, generating noisy alerts instead.

Was the (white-listing) fix breaking major contracts with the consumers of the library to deserve a new major version?

[JLLeitschuh]

I've emailed the maintainer to ask to make the issue public again

[syalaverthi]

@JLLeitschuh Does CVE-2022-1471 vulnerability apply if one uses SafeConstructor but with a SnakeYaml version of 1.33 or below?

[JLLeitschuh]

From the maintainer regarding why that issue is not public currently:

Unfortunately, Bitbucket faces a spam attack for issue tracker. Many projects involved including SnakeYAML. I closed it because they recommended to close it temp-ly.
I hope to open it soon.
https://community.atlassian.com/t5/Bitbucket-questions/Spam-attack-on-issue-tracker/qaq-p/2299344#U2299607

[JLLeitschuh]

@JLLeitschuh Does CVE-2022-1471 vulnerability apply if one uses SafeConstructor but with a SnakeYaml version of 1.33 or below?

If you are using SafeConstructor you are indeed safe.

[syalaverthi]

@JLLeitschuh Thank you for confirming. Appreciate it.

[JLLeitschuh]

The link works again now!