PT-2018-15443 · Yaml Cpp+3 · Yaml-Cpp+3

E4Ck

·

Publicado

2018-12-28

·

Atualizado

2025-11-03

·

CVE-2018-20573

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions yaml-cpp version 0.6.2
Description The issue allows remote attackers to cause a denial of service, resulting in stack consumption and application crash, via a crafted YAML file. This is due to a problem in the Scanner::EnsureTokensInQueue function.
Recommendations For yaml-cpp version 0.6.2, consider avoiding the use of the Scanner::EnsureTokensInQueue function until a patch is available. As a temporary workaround, restrict the processing of crafted YAML files to minimize the risk of exploitation.

Exploit

Correção

DoS

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2020-1758
AZL-7006
BDU:2025-12508
CVE-2018-20573
OPENSUSE-SU-2022:1073-1
OPENSUSE-SU-2022_1073-1
SUSE-SU-2022:1072-1
SUSE-SU-2022:1073-1
SUSE-SU-2022:1073-2
SUSE-SU-2022_1073-1
SUSE-SU-2023:1740-3
SUSE-SU-2023_1740-3

Produtos afetados

Alt Linux
Astra Linux
Suse
Yaml-Cpp