USN-6287-1: Go yaml vulnerabilities
14 August 2023
Several security issues were patched in the Go yaml package.
Releases
Packages
- golang-yaml.v2 - YAML support for the Go language
Details
Simon Ferquel discovered that the Go yaml package incorrectly handled
certain YAML documents. If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause the system to crash, resulting in
a denial of service. (CVE-2021-4235)
It was discovered that the Go yaml package incorrectly handled
certain large YAML documents. If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause the system to crash, resulting in
a denial of service. (CVE-2022-3064)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
Ubuntu 18.04
-
golang-gopkg-yaml.v2-dev
-
0.0+git20170407.0.cd8b52f-1ubuntu2+esm1
Available with Ubuntu Pro
-
golang-yaml.v2-dev
-
0.0+git20170407.0.cd8b52f-1ubuntu2+esm1
Available with Ubuntu Pro
Ubuntu 16.04
-
golang-yaml.v2-dev
-
0.0+git20160301.0.a83829b-1ubuntu0.1~esm1
Available with Ubuntu Pro
After a standard system update anything that depends on golang-yaml.v2 needs
to be rebuilt to make all the necessary changes.