Fluid Attacks Database

Description

gopkg.in/yaml.v3 Denial of Service An issue in the Unmarshal function in Go-Yaml v3 can cause a program to panic when attempting to deserialize invalid input.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	golang-gopkg-yaml.v3	=3.0.0~git20200121.a6ecf24-3 \|\| =3.0.0~git20210107.496545a-1 \|\| =3.0.1-1 \|\| =3.0.1-1~bpo11+1 \|\| =3.0.1-2 \|\| =3.0.1-3 \|\| =3.0.4-1 \|\| =3.0.4-2 \|\| =3.0.4-3 \|\| =3.0.4-3~bpo13+1	-
debian 12	golang-gopkg-yaml.v3	>=0 <3.0.1-1	3.0.1-1
go	gopkg.in/yaml.v3	>=0 <3.0.1	3.0.1
debian 14	golang-gopkg-yaml.v3	>=0 <3.0.1-1	3.0.1-1
debian 13	golang-gopkg-yaml.v3	>=0 <3.0.1-1	3.0.1-1

Aliases

1. CVE-2022-289482. NVD-2022-289483. OSV-DEBIAN-2022-289484. OSV-2022-289485. GCVE-2022-289486. SECURITY-TRACKER-CVE-2022-28948

References

1. https://github.com/go-yaml/yaml/issues/6652. https://github.com/go-yaml/yaml/issues/6663. https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf67544. https://github.com/go-yaml/yaml/commit/f6f7691b1fdeb513f56608cd2c32c51f8194bf515. https://security.netapp.com/advisory/ntap-20220923-0006

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.