Bug 2156727 (CVE-2021-4235)
| Summary: | CVE-2021-4235 go-yaml: Denial of Service in go-yaml | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Avinash Hanwate <ahanwate> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | adudiak, bcoca, bdettelb, bkundu, davidn, dcadzow, dfreiber, dkenigsb, dymurray, eglynn, ellin, epacific, etamir, fdeutsch, gparvin, hchiramm, ibolton, jburrell, jcammara, jchui, jhardy, jjoyce, jmatthew, jmontleo, jneedle, jobarker, jwendell, jwon, kshier, lball, lhh, mabashia, madam, matzew, mburns, mgarciac, muagarwa, nbecker, njean, ocs-bugs, oramraz, osapryki, oskutka, ovanders, owatkins, pahickey, phoracek, rcernich, rgarg, rhuss, rogbas, rrajasek, scorneli, sgott, shbose, simaishi, slucidi, smcdonal, smullick, sostapov, spower, sseago, stcannon, teagle, tfister, tnielsen, twalsh, ubhargav, vkumar, yguenane, zsadeh |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | go-yaml 2.2.3 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in go-yaml. This issue occurs due to unbounded alias chasing, where a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-01-25 18:22:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2158133, 2158134, 2158135, 2158136, 2158137, 2158138, 2158139, 2158140, 2158142, 2158143, 2158144, 2158145, 2158146, 2158147, 2158148, 2158149, 2158150, 2158152, 2158153, 2158154, 2158156, 2158157, 2159172, 2159173 | ||
| Bug Blocks: | 2156728 | ||
|
Description
Avinash Hanwate
2022-12-28 11:14:39 UTC
Created golang-gopkg-yaml tracking bugs for this issue: Affects: epel-7 [bug 2158142] Created golang-gopkg-yaml-1 tracking bugs for this issue: Affects: fedora-36 [bug 2158144] Affects: fedora-37 [bug 2158150] Created golang-gopkg-yaml-2 tracking bugs for this issue: Affects: fedora-36 [bug 2158145] Affects: fedora-37 [bug 2158152] Created golang-gopkg-yaml-3 tracking bugs for this issue: Affects: fedora-36 [bug 2158146] Affects: fedora-37 [bug 2158153] Created golang-k8s-sample-cli-plugin tracking bugs for this issue: Affects: fedora-36 [bug 2158147] Created golang-sigs-k8s-kustomize tracking bugs for this issue: Affects: fedora-36 [bug 2158148] Affects: fedora-37 [bug 2158154] Created golang-sigs-k8s-kustomize-kyaml tracking bugs for this issue: Affects: fedora-36 [bug 2158149] Created manifest-tool tracking bugs for this issue: Affects: epel-7 [bug 2158143] This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2022:7398 https://access.redhat.com/errata/RHSA-2022:7398 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-4235 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-4235 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2023:0570 https://access.redhat.com/errata/RHSA-2023:0570 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2023:0569 https://access.redhat.com/errata/RHSA-2023:0569 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326 This issue has been addressed in the following products: RHODF-4.13-RHEL-9 Via RHSA-2023:3742 https://access.redhat.com/errata/RHSA-2023:3742 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2023:3615 https://access.redhat.com/errata/RHSA-2023:3615 |