{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Stackable GmbH and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "product-security@stackable.tech", "issuing_authority": "The Stackable Security Team is responsible for vulnerability handling across all Stackable offerings.", "name": "Stackable GmbH", "namespace": "https://www.stackable.tech/" }, "title": "Stackable Security Advisory for: CVE-2022-1471", "tracking": { "current_release_date": "2026-07-13T09:49:30.052342Z", "generator": { "engine": { "name": "SecObserve", "version": "1.54.0" } }, "id": "CVE-2022-1471", "initial_release_date": "2026-07-13T09:49:30.052342Z", "revision_history": [ { "date": "2026-07-13T09:49:30.052342Z", "number": "1", "summary": "Initial release" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "33.0.0-stackable25.11.0-amd64", "product": { "name": "druid:33.0.0-stackable25.11.0-amd64", "product_id": "pkg:oci/druid@sha256%3A5cd603012618d66d2c46cac48a3ac85da4e55746086d90ddd8773e8d695cd51b?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fdruid", "product_identification_helper": { "purl": "pkg:oci/druid@sha256:5cd603012618d66d2c46cac48a3ac85da4e55746086d90ddd8773e8d695cd51b?arch=amd64&repository_url=oci.stackable.tech/sdp/druid" } } } ], "category": "product_name", "name": "druid" }, { "branches": [ { "category": "product_version", "name": "2.6.2-stackable25.11.0-amd64", "product": { "name": "hbase:2.6.2-stackable25.11.0-amd64", "product_id": "pkg:oci/hbase@sha256%3Ae4a52426c37da32cc8d0bb57520b982a22ec1897ace8cf77fcf6ed2c2c5bd47c?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_identification_helper": { "purl": "pkg:oci/hbase@sha256:e4a52426c37da32cc8d0bb57520b982a22ec1897ace8cf77fcf6ed2c2c5bd47c?arch=amd64&repository_url=oci.stackable.tech/sdp/hbase" } } }, { "category": "product_version", "name": "2.6.3-stackable25.11.0-amd64", "product": { "name": "hbase:2.6.3-stackable25.11.0-amd64", "product_id": "pkg:oci/hbase@sha256%3A3dedc2a37324b69c65e4970e35a3b2edbe4b7dc9489205aa6587f1d2efb54f14?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_identification_helper": { "purl": "pkg:oci/hbase@sha256:3dedc2a37324b69c65e4970e35a3b2edbe4b7dc9489205aa6587f1d2efb54f14?arch=amd64&repository_url=oci.stackable.tech/sdp/hbase" } } }, { "category": "product_version", "name": "2.6.3-stackable26.3.0-amd64", "product": { "name": "hbase:2.6.3-stackable26.3.0-amd64", "product_id": "pkg:oci/hbase@sha256%3Ae7cef91e22c6d63e1e80f8ce52d4584f0b7080f7e02c1d68230aef10a4eb1ffe?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_identification_helper": { "purl": "pkg:oci/hbase@sha256:e7cef91e22c6d63e1e80f8ce52d4584f0b7080f7e02c1d68230aef10a4eb1ffe?arch=amd64&repository_url=oci.stackable.tech/sdp/hbase" } } }, { "category": "product_version", "name": "2.6.4-stackable26.3.0-amd64", "product": { "name": "hbase:2.6.4-stackable26.3.0-amd64", "product_id": "pkg:oci/hbase@sha256%3A716b70efee3c0a8c5d4502e2180d065047a3db5c6aefe50be878ab87cc49cb95?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_identification_helper": { "purl": "pkg:oci/hbase@sha256:716b70efee3c0a8c5d4502e2180d065047a3db5c6aefe50be878ab87cc49cb95?arch=amd64&repository_url=oci.stackable.tech/sdp/hbase" } } } ], "category": "product_name", "name": "hbase" } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "33.0.0-stackable25.11.0-arm64", "product": { "name": "druid:33.0.0-stackable25.11.0-arm64", "product_id": "pkg:oci/druid@sha256%3A4062aced4b6bd52fc0b71c8d55b2941ea759d99b239436aa2f726d1b857dd4d4?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fdruid", "product_identification_helper": { "purl": "pkg:oci/druid@sha256:4062aced4b6bd52fc0b71c8d55b2941ea759d99b239436aa2f726d1b857dd4d4?arch=arm64&repository_url=oci.stackable.tech/sdp/druid" } } } ], "category": "product_name", "name": "druid" }, { "branches": [ { "category": "product_version", "name": "2.6.2-stackable25.11.0-arm64", "product": { "name": "hbase:2.6.2-stackable25.11.0-arm64", "product_id": "pkg:oci/hbase@sha256%3A30df45f2c5eb190ce17d6f83bbeeff02d768829828f625e0f0268b04b7602411?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_identification_helper": { "purl": "pkg:oci/hbase@sha256:30df45f2c5eb190ce17d6f83bbeeff02d768829828f625e0f0268b04b7602411?arch=arm64&repository_url=oci.stackable.tech/sdp/hbase" } } }, { "category": "product_version", "name": "2.6.3-stackable25.11.0-arm64", "product": { "name": "hbase:2.6.3-stackable25.11.0-arm64", "product_id": "pkg:oci/hbase@sha256%3Aec4517ad4613be5fe96b9a577f90ef7f76f8f5e17d9365bfeec2e75f606e8b9e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_identification_helper": { "purl": "pkg:oci/hbase@sha256:ec4517ad4613be5fe96b9a577f90ef7f76f8f5e17d9365bfeec2e75f606e8b9e?arch=arm64&repository_url=oci.stackable.tech/sdp/hbase" } } }, { "category": "product_version", "name": "2.6.3-stackable26.3.0-arm64", "product": { "name": "hbase:2.6.3-stackable26.3.0-arm64", "product_id": "pkg:oci/hbase@sha256%3A76c05838828ef763dbb86d8ad8ae8b8d746bcb436db22a6b28646f67abba9389?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_identification_helper": { "purl": "pkg:oci/hbase@sha256:76c05838828ef763dbb86d8ad8ae8b8d746bcb436db22a6b28646f67abba9389?arch=arm64&repository_url=oci.stackable.tech/sdp/hbase" } } }, { "category": "product_version", "name": "2.6.4-stackable26.3.0-arm64", "product": { "name": "hbase:2.6.4-stackable26.3.0-arm64", "product_id": "pkg:oci/hbase@sha256%3Aa7ef92f14eb476dd8b59a6ef5d53111011bbb8ad7be2eabff053ab15d8b213f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_identification_helper": { "purl": "pkg:oci/hbase@sha256:a7ef92f14eb476dd8b59a6ef5d53111011bbb8ad7be2eabff053ab15d8b213f6?arch=arm64&repository_url=oci.stackable.tech/sdp/hbase" } } } ], "category": "product_name", "name": "hbase" } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "Stackable" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "1.33", "product": { "name": "snakeyaml:1.33", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33", "product_identification_helper": { "purl": "pkg:maven/org.yaml/snakeyaml@1.33" } } } ], "category": "product_name", "name": "snakeyaml" } ], "category": "vendor", "name": "org.yaml" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/druid@sha256%3A5cd603012618d66d2c46cac48a3ac85da4e55746086d90ddd8773e8d695cd51b?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fdruid", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/druid@sha256%3A5cd603012618d66d2c46cac48a3ac85da4e55746086d90ddd8773e8d695cd51b?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fdruid" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/druid@sha256%3A5cd603012618d66d2c46cac48a3ac85da4e55746086d90ddd8773e8d695cd51b?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fdruid" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Ae4a52426c37da32cc8d0bb57520b982a22ec1897ace8cf77fcf6ed2c2c5bd47c?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Ae4a52426c37da32cc8d0bb57520b982a22ec1897ace8cf77fcf6ed2c2c5bd47c?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/hbase@sha256%3Ae4a52426c37da32cc8d0bb57520b982a22ec1897ace8cf77fcf6ed2c2c5bd47c?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A3dedc2a37324b69c65e4970e35a3b2edbe4b7dc9489205aa6587f1d2efb54f14?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A3dedc2a37324b69c65e4970e35a3b2edbe4b7dc9489205aa6587f1d2efb54f14?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/hbase@sha256%3A3dedc2a37324b69c65e4970e35a3b2edbe4b7dc9489205aa6587f1d2efb54f14?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/druid@sha256%3A4062aced4b6bd52fc0b71c8d55b2941ea759d99b239436aa2f726d1b857dd4d4?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fdruid", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/druid@sha256%3A4062aced4b6bd52fc0b71c8d55b2941ea759d99b239436aa2f726d1b857dd4d4?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fdruid" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/druid@sha256%3A4062aced4b6bd52fc0b71c8d55b2941ea759d99b239436aa2f726d1b857dd4d4?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fdruid" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A30df45f2c5eb190ce17d6f83bbeeff02d768829828f625e0f0268b04b7602411?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A30df45f2c5eb190ce17d6f83bbeeff02d768829828f625e0f0268b04b7602411?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/hbase@sha256%3A30df45f2c5eb190ce17d6f83bbeeff02d768829828f625e0f0268b04b7602411?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Aec4517ad4613be5fe96b9a577f90ef7f76f8f5e17d9365bfeec2e75f606e8b9e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Aec4517ad4613be5fe96b9a577f90ef7f76f8f5e17d9365bfeec2e75f606e8b9e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/hbase@sha256%3Aec4517ad4613be5fe96b9a577f90ef7f76f8f5e17d9365bfeec2e75f606e8b9e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Ae7cef91e22c6d63e1e80f8ce52d4584f0b7080f7e02c1d68230aef10a4eb1ffe?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Ae7cef91e22c6d63e1e80f8ce52d4584f0b7080f7e02c1d68230aef10a4eb1ffe?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/hbase@sha256%3Ae7cef91e22c6d63e1e80f8ce52d4584f0b7080f7e02c1d68230aef10a4eb1ffe?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A716b70efee3c0a8c5d4502e2180d065047a3db5c6aefe50be878ab87cc49cb95?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A716b70efee3c0a8c5d4502e2180d065047a3db5c6aefe50be878ab87cc49cb95?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/hbase@sha256%3A716b70efee3c0a8c5d4502e2180d065047a3db5c6aefe50be878ab87cc49cb95?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A76c05838828ef763dbb86d8ad8ae8b8d746bcb436db22a6b28646f67abba9389?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A76c05838828ef763dbb86d8ad8ae8b8d746bcb436db22a6b28646f67abba9389?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/hbase@sha256%3A76c05838828ef763dbb86d8ad8ae8b8d746bcb436db22a6b28646f67abba9389?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Aa7ef92f14eb476dd8b59a6ef5d53111011bbb8ad7be2eabff053ab15d8b213f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "product_id": "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Aa7ef92f14eb476dd8b59a6ef5d53111011bbb8ad7be2eabff053ab15d8b213f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" }, "product_reference": "pkg:maven/org.yaml/snakeyaml@1.33", "relates_to_product_reference": "pkg:oci/hbase@sha256%3Aa7ef92f14eb476dd8b59a6ef5d53111011bbb8ad7be2eabff053ab15d8b213f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-1471", "flags": [ { "label": "vulnerable_code_cannot_be_controlled_by_adversary", "product_ids": [ "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Ae7cef91e22c6d63e1e80f8ce52d4584f0b7080f7e02c1d68230aef10a4eb1ffe?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A716b70efee3c0a8c5d4502e2180d065047a3db5c6aefe50be878ab87cc49cb95?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A76c05838828ef763dbb86d8ad8ae8b8d746bcb436db22a6b28646f67abba9389?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Aa7ef92f14eb476dd8b59a6ef5d53111011bbb8ad7be2eabff053ab15d8b213f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" ] } ], "notes": [ { "category": "description", "text": "SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Ae4a52426c37da32cc8d0bb57520b982a22ec1897ace8cf77fcf6ed2c2c5bd47c?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" ], "known_not_affected": [ "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Ae7cef91e22c6d63e1e80f8ce52d4584f0b7080f7e02c1d68230aef10a4eb1ffe?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A716b70efee3c0a8c5d4502e2180d065047a3db5c6aefe50be878ab87cc49cb95?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A76c05838828ef763dbb86d8ad8ae8b8d746bcb436db22a6b28646f67abba9389?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Aa7ef92f14eb476dd8b59a6ef5d53111011bbb8ad7be2eabff053ab15d8b213f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" ] }, "references": [ { "category": "external", "summary": "Security Advisory", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" } ], "threats": [ { "category": "impact", "details": "This vulnerability is introduced via JRuby. The use of the JRuby runtime environment within the Apache HBase project is strictly confined to the administrative command-line interface, the hbase-shell. The core data-serving daemons, namely the HBase Master and RegionServers, are implemented entirely in Java and do not utilize JRuby, thereby isolating the vulnerability from the production data path and core cluster operations.\n\nAdditionally, according to a JRuby maintainer, JRuby is not affected by any SnakeYaml deserialization attacks.", "product_ids": [ "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Ae7cef91e22c6d63e1e80f8ce52d4584f0b7080f7e02c1d68230aef10a4eb1ffe?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A716b70efee3c0a8c5d4502e2180d065047a3db5c6aefe50be878ab87cc49cb95?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3A76c05838828ef763dbb86d8ad8ae8b8d746bcb436db22a6b28646f67abba9389?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase", "pkg:maven/org.yaml/snakeyaml@1.33@pkg:oci/hbase@sha256%3Aa7ef92f14eb476dd8b59a6ef5d53111011bbb8ad7be2eabff053ab15d8b213f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhbase" ] } ], "title": "CVE-2022-1471" } ] }