Bug 1719063

Summary:	js-yaml: parsing of malicious YAML with load() allows for code execution
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, aos-bugs, bleanhar, bmontgom, ccoleman, cmacedo, dedgar, dffrench, drusso, eparis, jburrell, jcantril, jgoulding, jjoyce, jmadigan, jokerman, jschluet, jshepherd, lhh, lpeer, mburns, mchappel, ngough, nodejs-sig, nstielau, pwright, sclewis, slinaber, slong, sponnaga, tchollingsworth, trepel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	js-yaml 3.13.1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-25 09:52:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1718309, 1719064, 1719065, 1719066, 1721723, 1721724
Bug Blocks:	1696235

Description Sam Fowler 2019-06-11 00:38:57 UTC

The js-yaml package, before version 3.13.1, is vulnerable to code execution when loading malicious yaml. When an object with an executable toString() property used as a map key, it will execute that function. This happens only for load(), which should not be used with untrusted data anyway. safeLoad() is not affected because it can't parse functions.


Upstream Fix:

https://github.com/nodeca/js-yaml/pull/480


Reference:

https://snyk.io/vuln/SNYK-JS-JSYAML-174129

Comment 1 Sam Fowler 2019-06-11 00:39:15 UTC

Created nodejs-js-yaml tracking bugs for this issue:

Affects: epel-all [bug 1719065]
Affects: fedora-all [bug 1719064]


Created python-XStatic-JS-Yaml tracking bugs for this issue:

Affects: openstack-rdo [bug 1719066]

Comment 2 Sam Fowler 2019-06-11 02:47:44 UTC

External Reference:

https://www.npmjs.com/advisories/813

Comment 6 Jason Shepherd 2019-08-08 05:49:46 UTC

This vulnerability is out of security support scope for the following product:

 * Red Hat Mobile Application Platform

 Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details

Comment 7 Sam Fowler 2020-05-28 07:58:37 UTC

This does not seem to be a vulnerability in the js-yaml package but rather it can result in a vulnerability if the load() method is used on untrusted input rather than safeLoad(). Any CVE assignments should be made to codebases using this package in an unsafe way, rather than the js-yaml package itself.