Denial of Service Vulnerability in yaml-cpp Package: CVE-2017-11692
Summary
UBUNTU-CVE-2017-11692: The function "Token& Scanner::peek" in scanner.cpp in yaml-cpp 0.5.3 and earlier allows remote attackers to cause a denial of service (assertion failure and application exit) via a '!2' string. Affects yaml-cpp versions 0.3.0-1 – 0.5.1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
yaml-cpp is a YAML parser and emitter in C++ that allows developers to work with YAML data structures easily. It is widely used in applications that require configuration files or data serialization. The package is known for its simplicity and efficiency, making it a popular choice among C++ developers. However, certain versions of yaml-cpp are vulnerable to a denial of service attack due to improper handling of specific input strings.
Vulnerability Detail
The vulnerability identified as CVE-2017-11692 arises from the function 'Token& Scanner::peek' in scanner.cpp within yaml-cpp versions 0.5.3 and earlier. This flaw allows remote attackers to trigger an assertion failure, leading to application crashes. The vulnerability can be exploited by sending specially crafted input strings, such as '!2', which can cause the application to exit unexpectedly, resulting in a denial of service. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out potentially harmful strings before they are processed by the yaml-cpp library. This can help prevent the application from crashing due to the vulnerability. For example, you can sanitize input data as follows:
if (inputString.find("!2") != std::string::npos) {
// Handle the invalid input appropriately
}
Conclusion
CVE-2017-11692 is a significant vulnerability in the yaml-cpp package that can lead to denial of service attacks. It is crucial for users to update their packages to the latest versions to mitigate this risk. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for yaml-cpp →
FAQ
CVE-2017-11692 is a vulnerability in the yaml-cpp package that allows remote attackers to cause a denial of service through specially crafted input strings.
Versions 0.5.3 and earlier of yaml-cpp are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If you cannot update the package, consider implementing input validation to filter out harmful strings as a temporary workaround.
The CVSS score for CVE-2017-11692 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for yaml-cpp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
