PT-2019-19993 · None · Js-Yaml

Publicado 2019-06-05 · Atualizado 2019-06-05

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 3.13.0

Description The issue allows for a Denial of Service by parsing a carefully-crafted YAML file, causing the node process to stall and potentially exhaust system resources.

Recommendations Upgrade to version 3.13.0.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-2PR6-76VF-7546

Produtos afetados

Js-Yaml

Referências · 6

• https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235 · Nota
• https://github.com/nodeca/js-yaml/issues/475 · Nota
• https://npmjs.com/advisories/788 · Nota
• https://snyk.io/vuln/SNYK-JS-JSYAML-173999 · Nota
• https://npmjs.com/advisories/788/versions · Nota
• https://osv.dev/vulnerability/GHSA-2pr6-76vf-7546 · Aviso do Fabricante