Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1yODhyLWdtcmgtN2o4M84AAwoS

YAML Go package vulnerable to denial of service

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

Permalink: https://github.com/advisories/GHSA-r88r-gmrh-7j83
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yODhyLWdtcmgtN2o4M84AAwoS
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: almost 2 years ago


CVSS Score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00095
EPSS Percentile: 0.41511

Identifiers: GHSA-r88r-gmrh-7j83, CVE-2021-4235
References: Repository: https://github.com/go-yaml/yaml
Blast Radius: 29.7

Affected Packages

go:github.com/go-yaml/yaml
Dependent packages: 864
Dependent repositories: 1,948
Downloads:
Affected Version Ranges: <= 2.1.0
No known fixed version
All affected versions: 2.0.0, 2.1.0
go:gopkg.in/yaml.v2
Dependent packages: 89,653
Dependent repositories: 247,600
Downloads:
Affected Version Ranges: < 2.2.3
Fixed in: 2.2.3
All affected versions: 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2
All unaffected versions: 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.3.0, 2.4.0