Denial of Service Vulnerability in YAML Package - LibYAML 0.1.5 and 0.1.6
Summary
ALPINE-CVE-2014-9130: scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wr... Affects yaml versions < 0.1.6-r1. Fixed in 0.1.6-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The YAML package, specifically versions 0.1.5 and 0.1.6 of LibYAML, is widely used for parsing and emitting YAML (YAML Ain't Markup Language) data. This package is integral in various programming environments, including Perl, where it is utilized in the YAML-LibYAML (YAML-XS) module. The vulnerability in question allows attackers to exploit the package's handling of line-wrapping, leading to potential application crashes.
Vulnerability Detail
The vulnerability arises from an assertion failure in the scanner.c file of LibYAML versions 0.1.5 and 0.1.6. Context-dependent attackers can exploit this flaw by providing specially crafted input that triggers the assertion failure, resulting in a denial of service (DoS) condition. This can lead to application crashes, affecting the availability of services that rely on the YAML package for data processing.
How To Fix
Minimum fixed version
0.1.6-r1
This is the first release that contains the fix.
sudo apk add --upgrade yamlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can validate and sanitize the input data before processing it with the YAML parser to mitigate the risk of triggering the vulnerability. However, this does not fully eliminate the risk and should only be considered a stopgap measure.
Conclusion
The vulnerability in the YAML package, specifically in LibYAML versions 0.1.5 and 0.1.6, poses a significant risk of denial of service attacks. Users are strongly advised to update to the patched version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for yaml →
FAQ
The vulnerability is a denial of service (DoS) issue caused by an assertion failure in the LibYAML library, which can lead to application crashes.
Versions 0.1.5 and 0.1.6 of LibYAML are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Update the YAML package to version 0.1.6-r1 or later using the command 'apk add yaml@edge' in Alpine Linux.
Yes, you can validate and sanitize input data before processing it with the YAML parser as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for yaml.
