YAML Go package vulnerable to denial of service
Date: 2022-12
Affected: go/github.com/go-yaml/yaml, go/gopkg.in/yaml.v2
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2021-4235
CVE-2022-3064
CWE: CWE-400
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.


Mitigations:

Architectural layers (MAESTRO):