Vulnerability CVE-2022-1471 - CERT Civis.Net

Vulnerability Name:

CVE-2022-1471 (CCN-241118)

Assigned:

2022-10-13

Published:

2022-10-13

Updated:

2023-04-25

Summary:

SnakeYaml could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the Constructor class. By using a specially-crafted yaml content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVSS v3 Severity:

8.3 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)
7.3 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): Low

8.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)
7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): Low

9.8 Critical (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.6 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

8.7 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Partial

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2022-1471

Source: cve-coordination@google.com
Type: Issue Tracking, Third Party Advisory
cve-coordination@google.com

Source: XF
Type: UNKNOWN
snakeyaml-cve20221471-code-exec(241118)

Source: CCN
Type: GITHub Web site
SnakeYaml: Constructor Deserialization Remote Code Execution

Source: cve-coordination@google.com
Type: Exploit, Third Party Advisory
cve-coordination@google.com

Source: cve-coordination@google.com
Type: Exploit, Third Party Advisory
cve-coordination@google.com

Source: CCN
Type: SnakeYaml GIT Repository
SnakeYaml

Source: cve-coordination@google.com
Type: UNKNOWN
cve-coordination@google.com

Source: cve-coordination@google.com
Type: Exploit, Third Party Advisory
cve-coordination@google.com

Source: CCN
Type: IBM Security Bulletin 6854713 (Voice Gateway)
Multiple Vulnerabilities in Java and Node.js packages affect IBM Voice Gateway

Source: CCN
Type: IBM Security Bulletin 6910171 (Integration Designer)
Multiple CVEs affect IBM Integration Designer

Source: CCN
Type: IBM Security Bulletin 6955071 (Cloud Pak for Network Automation)
IBM Cloud Pak for Network Automation v2.4.3 addresses multiple security vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6955765 (Watson Assistant for Cloud Pak for Data)
IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to SnakeYaml code execution (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 6962201 (Robotic Process Automation)
Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Source: CCN
Type: IBM Security Bulletin 6966902 (Maximo Data Loader)
There is a security vulnerability in snakeYAML used by IBM Maximo Data Loader (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 6969753 (Log Analysis)
Multiple Vulnerabilities related to SnakeYAML in Logstash shipped with IBM Operations Analytics - Log Analysis

Source: CCN
Type: IBM Security Bulletin 6981067 (Spectrum Scale)
A vulnerability has been identified in IBM Spectrum Scale GUI where remote authenticated attacker can execute an arbitrary code on the system (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 6988027 (Business Automation Workflow containers)
Deserialization vulnerability affect IBM Business Automation Workflow BPM Event Emitters - CVE-2022-1471

Source: CCN
Type: IBM Security Bulletin 6988563 (Process Mining)
Vulnerability in SnakeYaml affects IBM Process Mining . CVE-2022-1471

Source: CCN
Type: IBM Security Bulletin 6988677 (InfoSphere Information Server)
IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in snakeYAML

Source: CCN
Type: IBM Security Bulletin 6997063 (Operational Decision Manager)
IBM Operational Decision Manager April 2023 - Multiple CVEs

Source: CCN
Type: IBM Security Bulletin 6998025 (Planning Analytics Workspace)
IBM Planning Analytics Workspace has addressed a vulnerability in SnakeYaml (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 6998753 (Cloud Transformation Advisor)
IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6998815 (Db2 Graph)
IBM Db2 Graph is vulnerable to deserialization due to Snakeyaml CVE-2022-1471

Source: CCN
Type: IBM Security Bulletin 6999981 (App Connect Enterprise Certified Container)
IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution due to [CVE-2022-1471]

Source: CCN
Type: IBM Security Bulletin 7001815 (QRadar User Behavior Analytics)
IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 7002485 (Watson Discovery)
IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in SnakeYAML

Source: CCN
Type: IBM Security Bulletin 7003513 (Workload Scheduler)
IBM Workload Scheduler potentially affected by a vulnerability in SnakeYaml (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 7004655 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 7005873 (Maximo Application Suite)
SnakeYaml is vulnerable to CVE-2022-1471 used by IBM Maximo Application Suite

Source: CCN
Type: IBM Security Bulletin 7007897 (Watson Speech Services Cartridge for Cloud Pak for Data)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a arbitrary code execution in SnakeYaml (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 7008449 (Db2 on Cloud Pak for Data)
Multiple vulnerabilities affect IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data

Source: CCN
Type: IBM Security Bulletin 7009021 (Cloud Pak for Business Automation)
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for June 2023

Source: CCN
Type: IBM Security Bulletin 7009747 (Watson Knowledge Catalog on-prem)
Multiple security vulnerabilities affecting Watson Knowledge Catalog for IBM Cloud Pak for Data

Source: CCN
Type: IBM Security Bulletin 7009901 (Watson Assistant for Cloud Pak for Data)
IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to SnakeYaml abitrary code execution vulnerability (CVE-2022-1471).

Source: CCN
Type: IBM Security Bulletin 7009963 (Match 360)
IBM Match 360 is vulnerable to SnakeYaml's Constructor() class that not restrict types which can be instantiated during deserialization (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 7011437 (UrbanCode Deploy)
IBM UrbanCode Deploy (UCD) is vulnerable to unsafe deserialization in SnakeYaml (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 7012437 (i Modernization Engine for Lifecycle Integration)
IBM i Modernization Engine for Lifecycle Integration is vulnerable to execution of arbitrary code on the system (CVE-2022-1471)

Source: CCN
Type: IBM Security Bulletin 7013297 (Db2 Web Query for i)
IBM Db2 Web Query for i is vulnerable to arbitrary code execution due to SnakeYaml [CVE-2022-1471]

Source: CCN
Type: IBM Security Bulletin 7014243 (Maximo Application Suite)
SnakeYaml is vulnerable to security CVEs used in IBM Maximo Application Suite - Monitor Component

Vulnerable Configuration:

Configuration RedHat 1:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

Configuration CCN 1:

cpe:/a:snakeyaml_project:snakeyaml:1.30:*:*:*:*:*:*:*

AND

cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:operational_decision_manager:8.10:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_transformation_advisor:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:log_analysis:1.3.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:log_analysis:1.3.6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:log_analysis:1.3.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:integration_designer:20.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_scale:5.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:workload_scheduler:9.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_user_behavior_analytics:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:planning_analytics_workspace:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.0.1:-:*:*:containers:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*

OR cpe:/a:ibm:business_automation_workflow:21.0.1:*:*:*:traditional:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.0.2:-:*:*:containers:*:*:*

OR cpe:/a:ibm:business_automation_workflow:21.0.3:-:*:*:containers:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:21.0.2:-:*:*:containers:*:*:*

OR cpe:/a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:4.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:4.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:22.0.1:-:*:*:containers:*:*:*

OR cpe:/a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:21.0.3.1:*:*:*:traditional:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:5.0:*:*:*:lts:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:maximo_application_suite:8.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:22.0.2:-:*:*:containers:*:*:*

OR cpe:/a:ibm:business_automation_workflow:22.0.2:*:*:*:traditional:*:*:*

OR cpe:/a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_scale:5.1.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:robotic_process_automation:21.0.7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:robotic_process_automation:23.0.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.redhat.rhsa:def:20229058	P	RHSA-2022:9058: prometheus-jmx-exporter security update (Important)	2022-12-15