Skip to content

RUSTSEC-2018-0006: Uncontrolled recursion leads to abort in deserialization #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
github-actions bot opened this issue Oct 22, 2021 · 0 comments
Closed
Labels
wontfix This will not be worked on

Comments

@github-actions
Copy link

Uncontrolled recursion leads to abort in deserialization

Details
Package yaml-rust
Version 0.3.5
URL chyh1990/yaml-rust#109
Date 2018-09-17
Patched versions >=0.4.1

Affected versions of this crate did not prevent deep recursion while
deserializing data structures.

This allows an attacker to make a YAML file with deeply nested structures
that causes an abort while deserializing it.

The flaw was corrected by checking the recursion depth.

Note: clap 2.33 is not affected by this because it uses yaml-rust
in a way that doesn't trigger the vulnerability. More specifically:

  1. The input to the YAML parser is always trusted - is included at compile
    time via include_str!.

  2. The nesting level is never deep enough to trigger the overflow in practice
    (at most 5).

See advisory page for additional details.

@urdh urdh added the wontfix This will not be worked on label Oct 22, 2021
@urdh urdh closed this as completed Oct 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
wontfix This will not be worked on
Projects
None yet
Development

No branches or pull requests

1 participant