Denial Of Service (DoS)

🗓️ 25 Apr 2023 09:35:08Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 27 Views

yaml DoS vulnerability in parseDocument and parseAllDocuments function

Reporter	Title	Published	Views	Family All 33
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	1 Aug 202314:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to YAML denial of service vulnerabilitiy [CVE-2023-2251]	1 Feb 202413:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Application Manager 4.5.1 addresses security vulnerability listed in CVE below.	18 Jul 202323:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	31 May 202317:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	31 May 202317:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion and IBM Storage Fusion HCI may be vulnerable to denial of service and improper file download via http-cache-semantics, Gin-Gonic, and YAML (CVE-2022-25881, CVE-2023-2251, CVE-2023-29401)	29 Aug 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	3 Jan 202413:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service due to [CVE-2023-2251]	25 May 202312:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to YAML denial of service (CVE-2023-2251)	29 Jun 202313:24	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.10 addresses multiple security vulnerabilities.	27 Sep 202321:11	–	ibm

Vulners

Node

node-yaml node-yamlMatch1.10.0-4debian

AND

debian debian_linuxMatch12

node-yaml node-yamlMatch1.10.0-2debian

AND

debian debian_linuxMatch999

yaml_project yamlRange2.0.0-5–2.2.1js

yaml_project yamlRange2.3.0-0–2.3.0-4js

Source	Link
github	www.github.com/eemeli/yaml/commit/984f5781ffd807e58cad3b5c8da1f940dab75fba
huntr	www.huntr.dev/bounties/4b494e99-5a3e-40d9-8678-277f3060e96c/
github	www.github.com/advisories/GHSA-f9xv-q969-pqx4
huntr	www.huntr.dev/bounties/4b494e99-5a3e-40d9-8678-277f3060e96c

07 Sep 2023 20:49Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

EPSS0.00574

SSVC