CVE-2020-8441

CRITICAL9.8EPSS 7.6%

Deserialization of Untrusted Data in JYaml

發布日:2022/5/24修改日:2024/2/21

描述

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.

受影響套件(1)

Maven/org.jyaml:jyamlfrom 0, <= 1.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-8441
WEBhttps://gist.github.com/j0lt-github/f5141abcacae63d434ecae211422153a
WEBhttps://github.com/mbechler/marshalsec
WEBhttps://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
WEBhttps://security.netapp.com/advisory/ntap-20200313-0001
WEBhttps://sourceforge.net/p/jyaml/bugs