Executive brief
A YAML parsing library used in JavaScript applications contains a flaw in its error handling code that can crash the application when processing certain malformed YAML input. An attacker can cause a denial of service by submitting specially crafted YAML that triggers an uncaught exception, disrupting service availability.
Technical details
This is an uncaught exception vulnerability (CWE-248) in eemeli/yaml's error pretty-printer that occurs when handling certain corner cases during YAML parsing. The vulnerability affects versions 2.0.0-5 through 2.2.1 and is triggered when processing specially crafted YAML input that reaches the error reporting code path. The attack is network-accessible with no authentication or user interaction required, as the library processes untrusted YAML data. An attacker can trigger an unhandled exception that crashes the application, resulting in denial of service. The fix was released in version 2.2.2, addressing the corner case failure in the error reporting function.
Affected products
- eemeli yaml 2.0.0-5 to 2.2.1
Timeline
- 2023-04-24: disclosed: Published in GitHub Advisory Database
- 2023-04-24: patched: Fix released in version 2.2.2