Denial-of-Service Vulnerability in yaml-cpp Package: CVE-2019-6292
Summary
UBUNTU-CVE-2019-6292: An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Affects yaml-cpp versions 0.3.0-1 – 0.5.1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yaml-cpp is a YAML parser and emitter in C++ that allows developers to work with YAML files easily. It is widely used in various applications for configuration management and data serialization. The package provides a simple API for parsing and generating YAML documents, making it a popular choice among C++ developers. However, certain versions of yaml-cpp are vulnerable to a stack exhaustion issue, which can lead to denial-of-service attacks.
Vulnerability Detail
An issue was discovered in singledocparser.cpp in yaml-cpp (LibYaml-C++) version 0.6.2. The vulnerability arises from a stack consumption problem caused by recursive stack frames in functions such as HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, and HandleNode. Remote attackers can exploit this vulnerability to cause a denial-of-service by sending specially crafted YAML files, leading to application crashes or unresponsiveness.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to restrict the types of YAML files that your application processes. This can help mitigate the risk of denial-of-service attacks by rejecting potentially harmful input before it reaches the yaml-cpp parser.
Conclusion
The CVE-2019-6292 vulnerability in the yaml-cpp package poses a significant risk of denial-of-service attacks due to stack exhaustion. It is crucial for users to update to the latest patched versions of the package and consider implementing input validation as a temporary measure to protect their applications.
See every vulnerability recorded for yaml-cpp →
FAQ
CVE-2019-6292 is a vulnerability in the yaml-cpp package that can lead to denial-of-service attacks due to stack exhaustion.
Versions of yaml-cpp prior to the patched releases, specifically 0.6.2, are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerability can lead to application crashes or unresponsiveness, affecting the availability of services that rely on yaml-cpp for processing YAML files.
Yes, implementing input validation to restrict the types of YAML files processed can help mitigate the risk of denial-of-service attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for yaml-cpp.
