CVE-2018-20993: Uncontrolled recursion in rust-yaml

August 25, 2021 (updated June 13, 2023)

Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth.

References

github.com/advisories/GHSA-hv87-47h9-jcvq
github.com/chyh1990/yaml-rust
github.com/chyh1990/yaml-rust/commit/d61b49cb90391fc4f7f72a1abe597476c8651a07
github.com/chyh1990/yaml-rust/pull/109
nvd.nist.gov/vuln/detail/CVE-2018-20993
rustsec.org/advisories/RUSTSEC-2018-0006.html

Code Behaviors & Features

Detect and mitigate CVE-2018-20993 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →