MEDIUM

GHSA-39vw-qp34-rmwf

Uncontrolled recursion leads to abort in deserialization

Details

Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/serde_yaml

Introduced in: 0.6.0-rc1Fixed in: 0.8.4

Upgrade serde_yaml to 0.8.4 or newer (ecosystem crates.io).

References

https://github.com/dtolnay/serde-yaml/pull/105[WEB]
https://github.com/dtolnay/serde-yaml/commit/b93aff6e904cffbbfd1f421b82f6dcc5ca19a4fd[WEB]
https://github.com/dtolnay/serde-yaml[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2018-0005.html[WEB]