{"data":{"id":"01d2eb82-ea7e-4096-ad3d-1e2cd21d7cbf","title":"CVE-2023-46302: Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml…","summary":"Apache Submarine versions from 0.7.0 before 0.8.0 contain a flaw in YAML handling. The YamlEntityProvider in submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java unmarshals user-supplied YAML requests through its readFrom method, and the bug is tied to snakeyaml, as described in CVE-2022-1471.","solution":"Fixed in 0.8.0, which replaces snakeyaml with jackson-dataformat-yaml; users are recommended to upgrade to version 0.8.0. If upgrading is not possible, cherry-pick PR https://github.com/apache/submarine/pull/1054 and rebuild the submarine-server image.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-46302","publishedAt":"2023-11-20T14:15:07.293Z","cveId":"CVE-2023-46302","cweIds":["CWE-502"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["apache-submarine@>= 0.7.0, < 0.8.0 (fixed: 0.8.0)"],"affectedPackageNames":["apache-submarine"],"affectedPackageRefs":["pypi:apache-submarine"],"affectedVendors":[],"affectedVendorsRaw":["Apache Submarine"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Apache Submarine unsafe YAML deserialization in REST request handling","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01761,"epssCheckedAt":"2026-11-04T18:09:12.821Z","kevDateAdded":null,"advisoryAliases":["GHSA-8hcr-5x2g-9f7j"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:39.672Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:46:38.694Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"apache-submarine","fixedVersion":"0.8.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:46:38.543Z"}]}}