CVE-2021-4235
YAML Go package vulnerable to denial of service
Résumé
YAML Go package vulnerable to denial of service
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Go
gopkg.in/yaml.v2
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.3"}]}]
Go
github.com/go-yaml/yaml
[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.1.0"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2021-4235 golang-yaml.v2 Corrigé dans: 2.2.8-1
- Ubuntu UBUNTU-CVE-2021-4235 golang-yaml.v2 Corrigé dans: 0.0+git20160301.0.a83829b-1ubuntu0.1~esm1
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web lists.debian.org
- web pkg.go.dev