PT-2012-3101 · Yaml · Yaml::Libyaml
Jan Lieskovsky
·
Publicado
2012-09-09
·
Atualizado
2024-06-15
·
CVE-2012-1152
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
YAML::LibYAML module version 0.38
Description
The issue concerns multiple format string vulnerabilities in the error reporting functionality of the YAML::LibYAML module. These vulnerabilities allow remote attackers to cause a denial of service, resulting in a process crash. The vulnerabilities can be exploited through format string specifiers in various YAML elements, including a YAML stream to the Load function, a YAML node to the load node function, a YAML mapping to the load mapping function, or a YAML sequence to the load sequence function.
Recommendations
For YAML::LibYAML module version 0.38, consider updating to a newer version that addresses these vulnerabilities. As a temporary workaround, restrict the use of the Load, load node, load mapping, and load sequence functions to minimize the risk of exploitation. Avoid using format string specifiers in YAML streams, nodes, mappings, and sequences until the issue is resolved.
Correção
Use of Externally-Controlled Format String
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Yaml::Libyaml