Vulnerabilites related to gopkg.in/yaml.v2 - gopkg.in/yaml.v2
cve-2021-4235
Vulnerability from cvelistv5
Published
2022-12-27 21:13
Modified
2025-02-13 16:28
Severity ?
EPSS score ?
Summary
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | gopkg.in/yaml.v2 | gopkg.in/yaml.v2 |
Version: 0 ≤ |
||||||
|
|||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T17:23:09.096Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://github.com/go-yaml/yaml/pull/375", }, { tags: [ "x_transferred", ], url: "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241", }, { tags: [ "x_transferred", ], url: "https://pkg.go.dev/vuln/GO-2021-0061", }, { tags: [ "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { collectionURL: "https://pkg.go.dev", defaultStatus: "unaffected", packageName: "gopkg.in/yaml.v2", product: "gopkg.in/yaml.v2", programRoutines: [ { name: "decoder.unmarshal", }, { name: "Decoder.Decode", }, { name: "Unmarshal", }, { name: "UnmarshalStrict", }, ], vendor: "gopkg.in/yaml.v2", versions: [ { lessThan: "2.2.3", status: "affected", version: "0", versionType: "semver", }, ], }, { collectionURL: "https://pkg.go.dev", defaultStatus: "affected", packageName: "github.com/go-yaml/yaml", product: "github.com/go-yaml/yaml", programRoutines: [ { name: "decoder.unmarshal", }, { name: "Decoder.Decode", }, { name: "Unmarshal", }, { name: "UnmarshalStrict", }, ], vendor: "github.com/go-yaml/yaml", }, ], credits: [ { lang: "en", value: "@simonferquel", }, ], descriptions: [ { lang: "en", value: "Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.", }, ], problemTypes: [ { descriptions: [ { description: "CWE 400: Uncontrolled Resource Consumption", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2023-07-05T23:06:18.281Z", orgId: "1bb62c36-49e3-4200-9d77-64a1400537cc", shortName: "Go", }, references: [ { url: "https://github.com/go-yaml/yaml/pull/375", }, { url: "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241", }, { url: "https://pkg.go.dev/vuln/GO-2021-0061", }, { url: "https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html", }, ], title: "Denial of service in gopkg.in/yaml.v2", }, }, cveMetadata: { assignerOrgId: "1bb62c36-49e3-4200-9d77-64a1400537cc", assignerShortName: "Go", cveId: "CVE-2021-4235", datePublished: "2022-12-27T21:13:42.393Z", dateReserved: "2022-07-29T18:56:20.415Z", dateUpdated: "2025-02-13T16:28:37.426Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2022-3064
Vulnerability from cvelistv5
Published
2022-12-27 21:17
Modified
2025-02-13 16:32
Severity ?
EPSS score ?
Summary
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| gopkg.in/yaml.v2 | gopkg.in/yaml.v2 |
Version: 0 ≤ |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T01:00:10.262Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://github.com/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5", }, { tags: [ "x_transferred", ], url: "https://github.com/go-yaml/yaml/releases/tag/v2.2.4", }, { tags: [ "x_transferred", ], url: "https://pkg.go.dev/vuln/GO-2022-0956", }, { tags: [ "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { collectionURL: "https://pkg.go.dev", defaultStatus: "unaffected", packageName: "gopkg.in/yaml.v2", product: "gopkg.in/yaml.v2", programRoutines: [ { name: "decoder.unmarshal", }, { name: "yaml_parser_increase_flow_level", }, { name: "yaml_parser_roll_indent", }, { name: "Decoder.Decode", }, { name: "Unmarshal", }, { name: "UnmarshalStrict", }, ], vendor: "gopkg.in/yaml.v2", versions: [ { lessThan: "2.2.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.", }, ], problemTypes: [ { descriptions: [ { description: "CWE 400: Uncontrolled Resource Consumption", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2023-09-15T20:06:24.297Z", orgId: "1bb62c36-49e3-4200-9d77-64a1400537cc", shortName: "Go", }, references: [ { url: "https://github.com/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5", }, { url: "https://github.com/go-yaml/yaml/releases/tag/v2.2.4", }, { url: "https://pkg.go.dev/vuln/GO-2022-0956", }, { url: "https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/", }, ], title: "Excessive resource consumption in gopkg.in/yaml.v2", }, }, cveMetadata: { assignerOrgId: "1bb62c36-49e3-4200-9d77-64a1400537cc", assignerShortName: "Go", cveId: "CVE-2022-3064", datePublished: "2022-12-27T21:17:41.860Z", dateReserved: "2022-08-30T15:40:50.104Z", dateUpdated: "2025-02-13T16:32:40.805Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }