CVE-2021-4235
YAML Go package vulnerable to denial of service
Summary
YAML Go package vulnerable to denial of service
Original description
The description as published by the source.
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
gopkg.in/yaml.v2
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.3"}]}]
Go
github.com/go-yaml/yaml
[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.1.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-4235 golang-yaml.v2 Fixed in: 2.2.8-1
- Ubuntu UBUNTU-CVE-2021-4235 golang-yaml.v2 Fixed in: 0.0+git20160301.0.a83829b-1ubuntu0.1~esm1
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web lists.debian.org
- web pkg.go.dev