Bug 1719063 - js-yaml: parsing of malicious YAML with load() allows for code execution
Summary: js-yaml: parsing of malicious YAML with load() allows for code execution
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1718309 1719064 1719065 1719066 1721723 1721724
Blocks: 1696235
TreeView+ depends on / blocked
 
Reported: 2019-06-11 00:38 UTC by Sam Fowler
Modified: 2021-10-25 09:52 UTC (History)
32 users (show)

Fixed In Version: js-yaml 3.13.1
Clone Of:
Environment:
Last Closed: 2021-10-25 09:52:24 UTC
Embargoed:


Attachments (Terms of Use)

Description Sam Fowler 2019-06-11 00:38:57 UTC
The js-yaml package, before version 3.13.1, is vulnerable to code execution when loading malicious yaml. When an object with an executable toString() property used as a map key, it will execute that function. This happens only for load(), which should not be used with untrusted data anyway. safeLoad() is not affected because it can't parse functions.


Upstream Fix:

https://github.com/nodeca/js-yaml/pull/480


Reference:

https://snyk.io/vuln/SNYK-JS-JSYAML-174129

Comment 1 Sam Fowler 2019-06-11 00:39:15 UTC
Created nodejs-js-yaml tracking bugs for this issue:

Affects: epel-all [bug 1719065]
Affects: fedora-all [bug 1719064]


Created python-XStatic-JS-Yaml tracking bugs for this issue:

Affects: openstack-rdo [bug 1719066]

Comment 2 Sam Fowler 2019-06-11 02:47:44 UTC
External Reference:

https://www.npmjs.com/advisories/813

Comment 6 Jason Shepherd 2019-08-08 05:49:46 UTC
This vulnerability is out of security support scope for the following product:

 * Red Hat Mobile Application Platform

 Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details

Comment 7 Sam Fowler 2020-05-28 07:58:37 UTC
This does not seem to be a vulnerability in the js-yaml package but rather it can result in a vulnerability if the load() method is used on untrusted input rather than safeLoad(). Any CVE assignments should be made to codebases using this package in an unsafe way, rather than the js-yaml package itself.


Note You need to log in before you can comment on or make changes to this bug.