Bug 1696231

Summary:	js-yaml: parsing of crafted YAML file leads to denial of service
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, aos-bugs, bleanhar, bmontgom, ccoleman, cmacedo, dedgar, dffrench, drusso, eparis, jburrell, jcantril, jgoulding, jjoyce, jmadigan, jokerman, jschluet, jshepherd, lhh, lpeer, mburns, mchappel, ngough, nodejs-sig, nstielau, pwright, sclewis, sfowler, slinaber, slong, sponnaga, tchollingsworth, trepel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	js-yaml 3.13.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-25 09:52:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1696232, 1696233, 1719068, 1721721, 1721722
Bug Blocks:	1696235

Description Dhananjay Arunesh 2019-04-04 11:45:01 UTC

Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Reference:
https://www.npmjs.com/package/js-yaml

Comment 1 Dhananjay Arunesh 2019-04-04 11:46:27 UTC

External References:

https://www.npmjs.com/advisories/788

Comment 2 Dhananjay Arunesh 2019-04-04 11:47:05 UTC

Created nodejs-js-yaml tracking bugs for this issue:

Affects: fedora-all [bug 1696232]

Comment 3 Dhananjay Arunesh 2019-04-04 11:47:29 UTC

Created nodejs-js-yaml tracking bugs for this issue:

Affects: epel-all [bug 1696233]

Comment 4 Sam Fowler 2019-05-02 04:55:32 UTC

Upstream Patches:

https://github.com/nodeca/js-yaml/commit/a567ef3c
https://github.com/nodeca/js-yaml/commit/f64c6737

Comment 5 Sam Fowler 2019-06-11 00:41:40 UTC

Created python-XStatic-JS-Yaml tracking bugs for this issue:

Affects: openstack-rdo [bug 1719068]

Comment 9 Jason Shepherd 2019-08-08 05:49:57 UTC

This vulnerability is out of security support scope for the following product:

 * Red Hat Mobile Application Platform

 Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details

Comment 10 Sam Fowler 2020-05-28 07:58:29 UTC

This does not seem to be a vulnerability in the js-yaml package but rather it can result in a vulnerability if the load() method is used on untrusted input rather than safeLoad(). Any CVE assignments should be made to codebases using this package in an unsafe way, rather than the js-yaml package itself.