ALT-PU-2026-8149: package snakeyaml update to version 2.5-alt2
Описание
This update upgrades snakeyaml to version 2.5-alt2.
Устраненные уязвимости14
Ссылки8
GHSA-3mc7-4q67-w48m
https://github.com/advisories/GHSA-3mc7-4q67-w48mGHSA-98wm-3w3q-mw94
https://github.com/advisories/GHSA-98wm-3w3q-mw94GHSA-9w3m-gqgf-c4p9
https://github.com/advisories/GHSA-9w3m-gqgf-c4p9GHSA-c4r9-r8fh-9vj2
https://github.com/advisories/GHSA-c4r9-r8fh-9vj2GHSA-hhhw-99gj-p3c3
https://github.com/advisories/GHSA-hhhw-99gj-p3c3GHSA-mjmj-j48q-9wg2
https://github.com/advisories/GHSA-mjmj-j48q-9wg2GHSA-w37g-rhq8-7m4j
https://github.com/advisories/GHSA-w37g-rhq8-7m4jСвязанные уязвимости
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
SnakeYaml's Constructor() class does not restrict types which can be i ...