PT-2018-15486 · Rust · Yaml-Rust

Published 2018-09-17 · Updated 2021-08-25 · CVE-2018-20993

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions yaml-rust versions prior to 0.4.1

Description An issue in the yaml-rust crate allows uncontrolled recursion during deserialization, which can be exploited by an attacker to create a YAML file with deeply nested structures. This can cause an abort while deserializing the file. The flaw was corrected by checking the recursion depth.

Recommendations For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of deeply nested YAML structures to minimize the risk of exploitation.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2018-20993

GHSA-HV87-47H9-JCVQ

RUSTSEC-2018-0006

Affected Products

Yaml-Rust

References · 12

• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20993 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20993 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-20993 · Security Note
• https://rustsec.org/advisories/RUSTSEC-2018-0006.html · Patch
• https://osv.dev/vulnerability/GHSA-hv87-47h9-jcvq · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2018-0006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20993 · Security Note
• https://ubuntu.com/security/CVE-2018-20993 · Vendor Advisory
• https://github.com/chyh1990/yaml-rust/pull/109 · Note
• https://github.com/chyh1990/yaml-rust · Note
• https://github.com/chyh1990/yaml-rust/commit/d61b49cb90391fc4f7f72a1abe597476c8651a07 · Note
• https://crates.io/crates/yaml-rust · Note