YAML Go package vulnerable to denial of service

🗓️ 28 Dec 2022 00:30:23Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 58 Views

YAML Go package vulnerability due to unbounded alias chasin

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion and IBM Storage Fusion HCI may be vulnerable to denial of service and link following via Go-Yaml, kube-apiserver, Golang Go and Beego	29 Aug 202321:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Connector for SAP is affected by security vulnerabilities	2 Apr 202418:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	26 Mar 202503:48	–	ibm
CBLMariner	CVE-2021-4235 affecting package etcd 3.5.1-6	27 Dec 202217:58	–	cbl_mariner
CBLMariner	CVE-2021-4235 affecting package application-gateway-kubernetes-ingress 1.4.0-27	12 Jan 202509:15	–	cbl_mariner
CBLMariner	CVE-2021-4235 affecting package podman for versions less than 5.6.1-2	28 Oct 202521:13	–	cbl_mariner
CBLMariner	CVE-2021-4235 affecting package buildah for versions less than 1.41.4-2	28 Oct 202521:13	–	cbl_mariner
Chainguard	CVE-2021-4235 vulnerabilities	27 Dec 202222:15	–	cgr
CNNVD	Go-Yaml 安全漏洞	27 Dec 202200:00	–	cnnvd
CVE	CVE-2021-4235	27 Dec 202221:13	–	cve

Vulners

Node

go-yaml yamlRange≤2.1.0go

OR

gopkg.in yaml.v2Range<2.2.3go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-4235
github	www.github.com/go-yaml/yaml/pull/375
github	www.github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241
pkg	www.pkg.go.dev/vuln/GO-2021-0061
lists	www.lists.debian.org/debian-lts-announce/2023/07/msg00001.html
github	www.github.com/advisories/GHSA-r88r-gmrh-7j83

11 Apr 2025 23:46Current

4.3Medium risk

Vulners AI Score4.3

CVSS 3.15.5

EPSS0.00415

SSVC

yaml go package vulnerability denial of service user input system resources