PT-2019-19993 · None · Js-Yaml

Published 2019-06-05 · Updated 2019-06-05

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 3.13.0

Description The issue allows for a Denial of Service by parsing a carefully-crafted YAML file, causing the node process to stall and potentially exhaust system resources.

Recommendations Upgrade to version 3.13.0.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-2PR6-76VF-7546

Affected Products

Js-Yaml

References · 6

• https://osv.dev/vulnerability/GHSA-2pr6-76vf-7546 · Vendor Advisory
• https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235 · Note
• https://github.com/nodeca/js-yaml/issues/475 · Note
• https://npmjs.com/advisories/788 · Note
• https://snyk.io/vuln/SNYK-JS-JSYAML-173999 · Note
• https://npmjs.com/advisories/788/versions · Note