GHSA-FMM9-3GV8-58F4

Vulnerability from github – Published: 2021-09-07 23:08 – Updated: 2021-09-08 14:47
VLAI?
Summary
Improper Handling of Missing Values in kaml
Details

Impact

Attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service.

This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected.

YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue, for example:

!<x>

The following is a sample application that demonstrates this issue:

import com.charleskorn.kaml.Yaml
import kotlinx.serialization.SerialName
import kotlinx.serialization.Serializable

@Serializable
private sealed class K {
    @Serializable
    @SerialName("x")
    data class X(
        val property: String? = null,
    ) : K()
}

const val s = """
!<x>
"""

fun main() {
    println("Started.")
    val result = Yaml.default.decodeFromString(K.serializer(), s)
    println("Finished, result is $result")
}

On vulnerable versions of kaml, the decodeFromString() operation hangs and never returns.

Patches

Version 0.35.3 or later contain the fix for this issue.

Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.35.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.charleskorn.kaml:kaml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.35.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-230",
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-07T18:02:13Z",
    "nvd_published_at": "2021-09-07T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nAttackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. \n\nThis only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected.\n\nYAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue, for example:\n\n```yaml\n!\u003cx\u003e\n```\n\nThe following is a sample application that demonstrates this issue:\n\n```kotlin\nimport com.charleskorn.kaml.Yaml\nimport kotlinx.serialization.SerialName\nimport kotlinx.serialization.Serializable\n\n@Serializable\nprivate sealed class K {\n    @Serializable\n    @SerialName(\"x\")\n    data class X(\n        val property: String? = null,\n    ) : K()\n}\n\nconst val s = \"\"\"\n!\u003cx\u003e\n\"\"\"\n\nfun main() {\n    println(\"Started.\")\n    val result = Yaml.default.decodeFromString(K.serializer(), s)\n    println(\"Finished, result is $result\")\n}\n```\n\nOn vulnerable versions of kaml, the `decodeFromString()` operation hangs and never returns. \n\n\n### Patches\nVersion 0.35.3 or later contain the fix for this issue.",
  "id": "GHSA-fmm9-3gv8-58f4",
  "modified": "2021-09-08T14:47:32Z",
  "published": "2021-09-07T23:08:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/charleskorn/kaml/security/advisories/GHSA-fmm9-3gv8-58f4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39194"
    },
    {
      "type": "WEB",
      "url": "https://github.com/charleskorn/kaml/issues/179"
    },
    {
      "type": "WEB",
      "url": "https://github.com/charleskorn/kaml/commit/e18785d043fc6324c81e968aae9764b4b060bc6a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/charleskorn/kaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Handling of Missing Values in kaml"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.