CVE-2022-3064
yaml package for Go can consume excessive amounts of CPU or memory
Summary
yaml package for Go can consume excessive amounts of CPU or memory
Original description
The description as published by the source.
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
gopkg.in/yaml.v2
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.4"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-3064 golang-yaml.v2 Fixed in: 2.2.8-1
- Ubuntu UBUNTU-CVE-2022-3064 golang-yaml.v2 Fixed in: 0.0+git20160301.0.a83829b-1ubuntu0.1~esm1
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web pkg.go.dev