Security update for snakeyaml

SUSE Security Update: Security update for snakeyaml
Announcement ID: SUSE-SU-2022:3560-1
Rating: important
References: #1183360 #1202932 #1203149 #1203153 #1203154 #1203158
Cross-References:CVE-2020-13936 CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752
Affected Products:
  • SUSE Linux Enterprise Module for SUSE Manager Server 4.1
  • SUSE Manager Server 4.1

An update that fixes 6 vulnerabilities is now available.

Description:

This update for snakeyaml fixes the following issues:
snakeyaml was upgraded to version 1.31:

- CVE-2022-25857: Fixed DoS due missing to nested depth limitation for collections (bsc#1202932). - CVE-2022-38749: Fixed DoS due to stack overflow in parser (bsc#1202932). - CVE-2022-38751: Fixed DoS due to parsing of untrusted yaml files (bsc#1203153). - CVE-2022-38752: Fixed DoS due to stack overflow in parser (bsc#1203154). - CVE-2022-38750: Fixed DoS due to parsing of untrusted yaml files (bsc#1203158). - CVE-2020-13936: Fixed arbitrary code execution when attacker is able to modify templates (bsc#1183360).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Module for SUSE Manager Server 4.1:
    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3560=1

Package List:

  • SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (noarch):
    • snakeyaml-1.31-150200.12.6.1

References: