Denial-of-Service Vulnerability in yaml-cpp Package
Summary
DEBIAN-CVE-2019-6292: An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Affects yaml-cpp versions < 0.6.3-1. Fixed in 0.6.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yaml-cpp is a YAML parser and emitter in C++ that allows developers to read and write YAML files easily. It is widely used in various applications for configuration management and data serialization. The package is known for its simplicity and efficiency in handling YAML data structures. However, a vulnerability has been identified in version 0.6.2, which can lead to stack exhaustion and potential denial-of-service attacks.
Vulnerability Detail
An issue was discovered in singledocparser.cpp in yaml-cpp (also known as LibYaml-C++) version 0.6.2. The vulnerability arises from a stack consumption problem caused by recursive stack frames in functions such as HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, and HandleNode. Remote attackers could exploit this vulnerability to cause a denial-of-service by sending specially crafted YAML files, leading to application crashes or unresponsiveness.
How To Fix
Minimum fixed version
0.6.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade yaml-cppTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing input validation to restrict the types of YAML files that can be processed by your application. This can help mitigate the risk of denial-of-service attacks until a proper update can be applied.
Conclusion
The yaml-cpp package has a critical vulnerability that can lead to denial-of-service attacks. It is essential to update to the patched version 0.6.3-1 or later to protect your applications. Additionally, consider using Vulert to monitor for vulnerabilities in your software and ensure timely updates.
See every vulnerability recorded for yaml-cpp →
FAQ
The vulnerability is a stack exhaustion issue that can lead to denial-of-service attacks when processing specially crafted YAML files.
The vulnerability affects yaml-cpp version 0.6.2 and earlier. Versions 0.6.3-1 and later contain the necessary fixes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can receive real-time alerts about vulnerabilities.
Exploitation of this vulnerability can lead to application crashes or unresponsiveness, impacting the availability of services relying on yaml-cpp.
Yes, implementing input validation to restrict the types of YAML files processed can help mitigate the risk of denial-of-service attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for yaml-cpp.
