Skip to content
Fencer Intel
high 8.3

CVE-2022-1471 in the critical feed json

Remote Code execution in SnakeYAML

published 3y ago modified last mo. also GHSA-mjmj-j48q-9wg2 , EUVD-2022-7690

cvss
8.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
99.5%
EPSS 99.5% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Metasploit

Summary

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Patch / fix

  • maven org.yaml:snakeyaml 2.0
  • snakeyaml_project snakeyaml 2.0
  • jenkins openshift 4.9 2.361.1.1675668150-1.el8
  • jenkins-2-plugins openshift 4.9 4.9.1675668922-1.el8
  • jenkins ocp tools 4.11 2.414.3.1698298955-3.el8
  • jenkins-2-plugins ocp tools 4.11 4.11.1698299029-1.el8
  • jenkins ocp tools 4.11 2.387.1.1683009763-3.el8
  • jenkins-2-plugins ocp tools 4.11 4.11.1683009941-1.el8
  • cjson satellite capsule 6.13, satellite 6.13 1.7.14-5.el8sat
  • foreman satellite utils 6.13, satellite capsule 6.13, satellite 6.13 3.5.1.14-1.el8sat

red hat advisories RHSA-2023:0777RHSA-2025:1747RHSA-2025:1746RHSA-2023:6171RHSA-2023:3198RHSA-2023:2097

  • prometheus-jmx-exporter AlmaLinux 8 0.12.0-9.el8_7
  • prometheus-jmx-exporter-openjdk8 AlmaLinux 8 0.12.0-9.el8_7
  • prometheus-jmx-exporter-openjdk11 AlmaLinux 8 0.12.0-9.el8_7
  • prometheus-jmx-exporter-openjdk17 AlmaLinux 8 0.12.0-9.el8_7

almalinux advisories ALSA-2022:9058

  • prometheus-jmx-exporter Rocky Linux 8 0.12.0-9.el8_7

rocky linux advisories RLSA-2022:9058

Is CVE-2022-1471 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1471 updated cvss 9.8

SnakeYaml: Constructor Deserialization Remote Code Execution

  • Red Hat A-MQ Clients 2 snakeyaml Red Hat build of Apache Camel for Spring Boot 3 snakeyaml
    affected: no fix available
  • Red Hat Data Grid 8 snakeyaml
    affected: no fix planned “Will not fix”
  • Red Hat Decision Manager 7 snakeyaml
    affected: no fix available
  • Red Hat Enterprise Linux 7 snakeyaml, snakeyaml-javadoc Red Hat Fuse 7 snakeyaml Red Hat Integration Camel K 1 snakeyaml Red Hat Integration Camel Quarkus 1 snakeyaml
    affected: no fix planned “Will not fix”
  • Red Hat Integration Service Registry snakeyaml Red Hat JBoss Data Grid 7 snakeyaml Red Hat JBoss Data Virtualization 6 snakeyaml Red Hat JBoss Enterprise Application Platform 6 snakeyaml, eap6-snakeyaml eap6-snakeyaml Red Hat JBoss Fuse 6 snakeyaml Red Hat JBoss Fuse Service Works 6 snakeyaml
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes snakeyaml Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins, openshift3/ose-metrics-cassandra, openshift3/ose-metrics-hawkular-metrics Red Hat Satellite 6 puppetserver Red Hat streams for Apache Kafka snakeyaml
    affected: no fix available
  • Red Hat Middleware Containers for OpenShift ubi8/openjdk-17 1.14-9, ubi8/openjdk-8 1.14-12, ubi8/openjdk-11 1.14-11, ubi8/openjdk-17-runtime 1.14-8, ubi8/openjdk-8-runtime 1.14-10, ubi8/openjdk-11-runtime 1.14-11, +1 more
    fixed: vendor fix RHSA-2023:1047
  • Red Hat Middleware RHEL 7 Containers for OpenShift openjdk/openjdk-11-rhel7 1.17-1, redhat-openjdk-18/openjdk18-openshift 1.17-1
    fixed: vendor fix RHSA-2024:0325
show 20 more
  • Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins 4.11.1683009941-1.el8, jenkins-2-plugins 4.11.1698299029-1.el8, jenkins-2-plugins 4.11.1706516946-1.el8
    fixed: vendor fix RHSA-2023:3198
  • Red Hat AMQ Clients
    fixed: vendor fix RHSA-2023:7697
  • Red Hat AMQ Streams 2.5.0
    fixed: vendor fix RHSA-2023:5165
  • Red Hat build of Eclipse Vert.x 4.3.4
    fixed: vendor fix RHSA-2022:9032
  • Red Hat build of Quarkus
    fixed: vendor fix RHSA-2023:0758
  • Red Hat build of Quarkus 2.7.7
    fixed: vendor fix RHSA-2023:1006
  • Red Hat Enterprise Linux AppStream (v. 8) prometheus-jmx-exporter 0.12.0-9.el8_7, prometheus-jmx-exporter-openjdk8 0.12.0-9.el8_7, prometheus-jmx-exporter-openjdk11 0.12.0-9.el8_7, prometheus-jmx-exporter-openjdk17 0.12.0-9.el8_7
    fixed: vendor fix RHSA-2022:9058
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2023:1512
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2023:1513
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:1514
  • Red Hat JBoss Enterprise Application Platform snakeyaml 1.33.0.SP1-redhat-00001
    fixed: vendor fix RHSA-2023:1516
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.ep7.el7, eap7-resteasy 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-cdi 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-jaxrs 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-jsapi 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-client 3.0.27-1.Final_redhat_00001.1.ep7.el7, +12 more
    fixed: vendor fix RHSA-2025:1746
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-cdi 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-jaxrs 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-jsapi 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-jackson-datatype-jdk8 2.10.4-2.redhat_00004.1.el7eap, +18 more
    fixed: vendor fix RHSA-2025:1747
  • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins 4.9.1675668922-1.el8
    fixed: vendor fix RHSA-2023:0777
  • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins 4.10.1675407676-1.el8
    fixed: vendor fix RHSA-2023:0697
  • Red Hat OpenShift Dev Spaces 3 devspaces/idea-rhel8 3.6-8, devspaces/udi-rhel8 3.6-20
    fixed: vendor fix RHEA-2023:3224
  • Red Hat Satellite 6.13 for RHEL 8 candlepin 4.2.13-1.el8sat, candlepin-selinux 4.2.13-1.el8sat
    fixed: vendor fix RHSA-2023:2097
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044

3 more fixed, 19 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (Metasploit exploit/multi/http/torchserver_cve_2023_43654)

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

99.50% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/multi/http/torchserver_cve_2023_43654 PyTorch Model Server Registration and Deserialization RCE metasploit exploit, excellent rank, 2023-10-03
  • github.com https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/mbechler/marshalsec referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected packages

ecosystem package affected fixed in
maven org.yaml:snakeyaml
<2.0
2.0

Affected products

  • SnakeYAML SnakeYAML

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.