PT-2012-3101 · Yaml · Yaml::Libyaml

Jan Lieskovsky · Published 2012-09-09 · Updated 2024-06-15 · CVE-2012-1152

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions YAML::LibYAML module version 0.38

Description The issue concerns multiple format string vulnerabilities in the error reporting functionality of the YAML::LibYAML module. These vulnerabilities allow remote attackers to cause a denial of service, resulting in a process crash. The vulnerabilities can be exploited through format string specifiers in various YAML elements, including a YAML stream to the Load function, a YAML node to the load node function, a YAML mapping to the load mapping function, or a YAML sequence to the load sequence function.

Recommendations For YAML::LibYAML module version 0.38, consider updating to a newer version that addresses these vulnerabilities. As a temporary workaround, restrict the use of the Load, load node, load mapping, and load sequence functions to minimize the risk of exploitation. Avoid using format string specifiers in YAML streams, nodes, mappings, and sequences until the issue is resolved.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2012-1152

DSA-2432-1

OPENSUSE-SU-2024:10520-1

Affected Products

Yaml::Libyaml

References · 25

• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077782.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1152 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077004.html · Vendor Advisory
• http://secunia.com/advisories/48317 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-08/msg00029.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1152 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html · Vendor Advisory
• http://debian.org/security/2012/dsa-2432 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-1152 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1152 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10520-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077023.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/03/09/6 · Note
• http://securityfocus.com/bid/52381 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73856 · Note