CVE-2022-28948: High severity yaml go vulnerability
A flaw was found in the Unmarshal function in Go-Yaml. The issue causes the program to crash when attempting to deserialize invalid input.
Other sources
An issue in the Unmarshal function in Go-Yaml v3 can cause a program to panic when attempting to deserialize invalid input.
— GitHub
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
Go-Yaml is vulnerable to a denial of service, caused by a flaw in the Unmarshal function. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause the program to crash.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-28948?
CVE-2022-28948 is a vulnerability in the Unmarshal function in Go-Yaml v3 that causes the program to crash when attempting to deserialize invalid input.
What is the severity of CVE-2022-28948?
CVE-2022-28948 has a severity of 7.5 (High).
How does CVE-2022-28948 affect the affected software?
CVE-2022-28948 affects gopkg.in/yaml.v3 package (version up to 3.0.0-20220521103104-8f96da9f5d5e) in Go, golang-gopkg-yaml package (version up to 3.0.0) in Red Hat, Yaml Project Yaml (version 3.0.0), and Netapp Astra Trident.
How can I fix CVE-2022-28948?
To fix CVE-2022-28948, update the affected software packages to version 3.0.0-20220521103104-8f96da9f5d5e for Go, version 3.0.0 for Red Hat, and version 3.0.0 for Yaml Project Yaml.
Where can I find more information about CVE-2022-28948?
You can find more information about CVE-2022-28948 on the following sources: - [CVE-2022-28948 on CVE](https://www.cve.org/CVERecord?id=CVE-2022-28948) - [CVE-2022-28948 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-28948) - [GitHub Advisory GHSA-hp87-p4gw-j4gq](https://github.com/advisories/GHSA-hp87-p4gw-j4gq)