GitHub Advisoryadvisory · crates.io

GHSA-hv87-47h9-jcvq Uncontrolled recursion in rust-yaml

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2018-20993
Ecosystem
crates.io
Packages
yaml-rust
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674
Reviewed
2021-08-19

Affected packages

• crates.io yaml-rust: < 0.4.1 → fixed in 0.4.1

Description

Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth.

Related

Alias · CVE (1)

  • CVE-2018-20993 An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References