UbuntuUpdates.org

Package "golang-yaml.v2"

Name: golang-yaml.v2

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • YAML support for the Go language
  • Transitional package for golang-gopkg-yaml.v2-dev
Latest version: 2.2.2-1ubuntu0.1
Release: focal (20.04)
Level: security
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "golang-yaml.v2" in Focal

Repository Area Version
base universe 2.2.2-1
updates universe 2.2.2-1ubuntu0.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.2.2-1ubuntu0.1 2023-08-14 09:07:04 UTC

  golang-yaml.v2 (2.2.2-1ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: DOS through excessive alias.
    - debian/patches/CVE-2021-4235.patch: Add logic to catch cases of
      alias abuse in decode.go.
    - CVE-2021-4235
  * SECURITY_UPDATE: DOS through nested or expansion in large documents.
    - debian/patches/CVE-2022-3064.patch: Improve heuristics preventing
      CPU/memory abuse in decode.go and scannerc.go.
    - CVE-2022-3064

 -- David Fernandez Gonzalez <email address hidden> Fri, 11 Aug 2023 09:47:30 +0200
CVE-2021-4235 Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input,
CVE-2022-3064 Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.


About   -   Send Feedback to @ubuntu_updates