Summary
Simon Ferquel discovered that the Go yaml package incorrectly handled
certain YAML documents. If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause the system to crash, resulting in
a denial of service. (CVE-2021-4235)
It was discovered that the Go yaml package incorrectly handled
certain large YAML documents. If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause the system to crash, resulting in
a denial of service. (CVE-2022-3064)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | golang-yaml.v2 | 2.2.2-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | golang-yaml.v2 | 0.0+git20160301.0.a83829b-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | golang-yaml.v2 | 0.0+git20170407.0.cd8b52f-1ubuntu2+esm1 |
Vulnerabilities 2
-
High 7.5
Excessive resource consumption in gopkg.in/yaml.v2
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
-
Medium 5.5
Denial of service in gopkg.in/yaml.v2
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.