This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-4235 →

DEBIAN-CVE-2021-4235

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, t...

Original description

The description as published by the source.

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 golang-yaml.v2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-1"}]}]

Debian:13 golang-yaml.v2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-1"}]}]

Debian:14 golang-yaml.v2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-1"}]}]

References

advisory security-tracker.debian.org