GO-2020-0036

vendorUSosv

Excessive resource consumption in YAML parsing in gopkg.in/yaml.v2

view advisory published 2021-04-14Licence: per source

Due to unbounded aliasing, a crafted YAML file can cause consumption of significant system resources. If parsing user supplied input, this may be used as a denial of service vector.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-11254US	medium6.5	3.16% (88th)	—	2020-04-01
The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the…

references

External citations — patches, advisories, analysis.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18496WEB
https://github.com/go-yaml/yaml/commit/53403b58ad1b561927d19068c655246f2db79d48FIX
https://github.com/go-yaml/yaml/pull/555FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan