OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2025-12-30 08:13:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into trust-dns-proto-0-4-3

Browse Source
This commit is contained in:
Tony Arcieri
2018-10-13 18:14:24 -07:00
committed by GitHub
parent d6b9d03e45 21428f953b
commit b825af523e
2 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
crates/serde_yaml/RUSTSEC-2018-0005.toml Normal file
View File

@@ -0,0 +1,18 @@
[advisory]
id = "RUSTSEC-2018-0005"
package = "serde_yaml"
date = "2018-09-17"
title = "Uncontrolled recursion leads to abort in deserialization"
description = """
Affected versions of this crate did not properly check for recursion
while deserializing aliases.
This allows an attacker to make a YAML file with an alias referring
to itself causing an abort.
The flaw was corrected by checking the recursion depth.
"""
patched_versions = [">= 0.8.4"]
unaffected_versions = ["< 0.6.0-rc1"]
url = "https://github.com/dtolnay/serde-yaml/pull/105"
keywords = ["crash"]

17
crates/yaml-rust/RUSTSEC-2018-0006.toml Normal file
View File

@@ -0,0 +1,17 @@
[advisory]
id = "RUSTSEC-2018-0006"
package = "yaml-rust"
date = "2018-09-17"
title = "Uncontrolled recursion leads to abort in deserialization"
description = """
Affected versions of this crate did not prevent deep recursion while
deserializing data structures.
This allows an attacker to make a YAML file with deeply nested structures
that causes an abort while deserializing it.
The flaw was corrected by checking the recursion depth.
"""
patched_versions = [">= 0.4.1"]
url = "https://github.com/chyh1990/yaml-rust/pull/109"
keywords = ["crash"]