Denial of Service Vulnerability in yaml-cpp Package - CVE-2018-20574
Summary
UBUNTU-CVE-2018-20574: The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file. Affects yaml-cpp versions 0.3.0-1 – 0.5.1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yaml-cpp is a YAML parser and emitter in C++ that allows developers to easily read and write YAML files. It is widely used in applications that require configuration files or data serialization. The package is known for its simplicity and efficiency, but it has been found to have vulnerabilities that can be exploited by attackers.
Vulnerability Detail
The vulnerability identified as CVE-2018-20574 exists in the SingleDocParser::HandleFlowMap function of yaml-cpp version 0.6.2. This flaw allows remote attackers to craft a malicious YAML file that can lead to a denial of service condition, causing stack consumption and application crashes. The vulnerability arises from improper handling of certain input, which can be exploited to exhaust system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted YAML files until the package has been updated. Implement input validation to ensure that only safe and expected YAML files are processed by your application.
Conclusion
CVE-2018-20574 is a significant vulnerability in the yaml-cpp package that can lead to denial of service attacks. Users are strongly advised to update their packages to the latest versions to protect their applications from potential exploitation.
See every vulnerability recorded for yaml-cpp →
FAQ
CVE-2018-20574 is a vulnerability in the yaml-cpp package that allows attackers to cause a denial of service through crafted YAML files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary impact is a denial of service, which can lead to application crashes and unavailability of services relying on yaml-cpp.
Yes, a patched version of yaml-cpp is available. Users should update to version 0.6.2-4ubuntu1 or later to mitigate the vulnerability.
The CVSS score for CVE-2018-20574 is 6.5, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for yaml-cpp.
