OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-19 18:05:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #60 from xfix/yaml-rust-advisory

Browse Source 
Add advisory for yaml-rust
This commit is contained in:
Tony Arcieri
2018-10-13 18:04:27 -07:00
committed by GitHub
parent e0a3c25201 2c3880df0d
commit 77103cc693
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
crates/yaml-rust/RUSTSEC-0000-0000.toml Normal file
View File

@@ -0,0 +1,17 @@
[advisory]
id = "RUSTSEC-0000-0000"
package = "yaml-rust"
date = "2018-09-17"
title = "Uncontrolled recursion leads to abort in deserialization"
description = """
Affected versions of this crate did not prevent deep recursion while
deserializing data structures.
This allows an attacker to make a YAML file with deeply nested structures
that causes an abort while deserializing it.
The flaw was corrected by checking the recursion depth.
"""
patched_versions = [">= 0.4.1"]
url = "https://github.com/chyh1990/yaml-rust/pull/109"
keywords = ["crash"]