CVE-2022-3064

2022-12-2722:15:14

CWE-400

[email protected]

web.nvd.nist.gov

257

cve-2022-3064

nvd

yaml

cpu consumption

memory consumption

information security

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.8%

JSON

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

Affected configurations

NVD

Node

yaml_projectyamlRange<2.2.4go

CPENameOperatorVersion
yaml_project:yamlyaml project yamllt2.2.4

CPE	Name	Operator	Version
yaml_project:yaml	yaml project yaml	lt	2.2.4

CNA Affected

[
  {
    "vendor": "gopkg.in/yaml.v2",
    "product": "gopkg.in/yaml.v2",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "gopkg.in/yaml.v2",
    "versions": [
      {
        "version": "0",
        "lessThan": "2.2.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "decoder.unmarshal"
      },
      {
        "name": "yaml_parser_increase_flow_level"
      },
      {
        "name": "yaml_parser_roll_indent"
      },
      {
        "name": "Decoder.Decode"
      },
      {
        "name": "Unmarshal"
      },
      {
        "name": "UnmarshalStrict"
      }
    ],
    "defaultStatus": "unaffected"
  }
]