Uncontrolled recursion leads to abort in deserialization

published 2018-09-17 8y ago modified 2023-11-08 3y ago also RUSTSEC-2018-0005

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.

Patch / fix

fixed in 1 links 2

crates.io serde_yaml 0.8.4

github.com/dtolnay/serde-yaml@b93aff6 commit
github.com/dtolnay/serde-yaml#105 pull request

Is GHSA-39vw-qp34-rmwf in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
crates.io	serde_yaml	>=0.6.0-rc1, <0.8.4	0.8.4

Classification

Weakness

CWE-674 Uncontrolled Recursion

References

github.com /dtolnay/serde-yaml/pull/105
web
github.com /dtolnay/serde-yaml/commit/b93aff6e904cffbbfd1f421b82f6dcc5ca19a4fd
web
github.com /dtolnay/serde-yaml
package
rustsec.org /advisories/RUSTSEC-2018-0005.html
web, advisory
crates.io /crates/serde_yaml
package

Sources

GitHub Advisory GHSA-39vw-qp34-rmwf
OSV RUSTSEC-2018-0005

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.