CVE-2022-38752¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Using SnakeYAML to parse untrusted YAML files may leave an application open to denial-of-service attacks. If the parser is running on user-supplied input, an attacker may supply content that causes it to crash by stack overflow.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.3.0
WSO2 JUSTIFICATION¶
Two SnakeYAML distributions reach the runtime in WSO2 Identity Server, and neither can be reached from untrusted input:
The distribution that serves the runtime is not affected. The only bundle that exports the org.yaml.snakeyaml packages to the OSGi runtime carries SnakeYAML 2.0, which is outside the affected range (<1.32). Everything in the product that parses YAML binds to this export.
The in-range copy is bundle-private and reads only local files. A second copy, SnakeYAML 1.31, is nested inside the Identity Server migration component. That bundle does not export org.yaml.snakeyaml, so the copy stays private to its own classloader. The only two classes in the bundle that use it read the operator-supplied ${carbon.home}/migration-resources/migration-config.yaml and the .yaml backup files that the migrator itself wrote during a previous migration step. Both are files on the server's own filesystem on the migration-client path; neither ever parses request data.
The exploit this CVE requires - attacker-supplied YAML reaching Yaml.load - therefore cannot occur in the product.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.