OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-03 18:15:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #61 from xfix/serde-yaml-advisory

Browse Source 
Add advisory for serde_yaml
This commit is contained in:
Tony Arcieri
2018-10-13 16:13:35 -07:00
committed by GitHub
parent b2125b68a5 f22c3798f6
commit 1c2f05360d
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
crates/serde_yaml/RUSTSEC-0000-0000.toml Normal file
View File

@@ -0,0 +1,18 @@
[advisory]
id = "RUSTSEC-0000-0000"
package = "serde_yaml"
date = "2018-09-17"
title = "Uncontrolled recursion leads to abort in deserialization"
description = """
Affected versions of this crate did not properly check for recursion
while deserializing aliases.
This allows an attacker to make a YAML file with an alias referring
to itself causing an abort.
The flaw was corrected by checking the recursion depth.
"""
patched_versions = [">= 0.8.4"]
unaffected_versions = ["< 0.6.0-rc1"]
url = "https://github.com/dtolnay/serde-yaml/pull/105"
keywords = ["crash"]