CVE-2021-4235: Denial of service in gopkg.in/yaml.v2
A flaw was found in go-yaml. This issue occurs due to unbounded alias chasing, where a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
Other sources
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
— Ubuntu
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-4235?
CVE-2021-4235 is a vulnerability caused by unbounded alias chasing in go-yaml, allowing a maliciously crafted YAML file to consume significant system resources and potentially be used as a denial of service vector.
How does CVE-2021-4235 impact the system?
CVE-2021-4235 can lead to excessive consumption of system resources when parsing user input, potentially causing a denial of service.
What software versions are affected by CVE-2021-4235?
The affected software versions include golang-yaml.v2 0.0+ (Ubuntu Bionic), golang-yaml.v2 2.2.2-1ubuntu0.1 (Ubuntu Focal), golang-yaml.v2 2.2.3 (Ubuntu upstream), golang-yaml.v2 0.0+ (Ubuntu Xenial), golang-yaml.v2 2.2.2-1+deb10u1, 2.4.0-1, 2.4.0-4 (Debian), go-yaml 2.2.3 (Red Hat), and openshift-clients 0:4.12.0-202301042257.p0.g854f807.assembly.stream.el9 (Red Hat).
What is the severity of CVE-2021-4235?
CVE-2021-4235 has a severity level of medium with a CVSS score of 5.5.
How can CVE-2021-4235 be fixed?
To fix CVE-2021-4235, it is recommended to update the affected software to the latest secure version provided by the respective vendors.