Bug 1226351

Summary:	VUL-0: CVE-2024-35326: python-ruamel.yaml: libyaml: double-free in yaml_emitter_emit in /src/libyaml/src/emitter.c
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Camila Camargo de Matos <camila.matos>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	IN_PROGRESS ---	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	camila.matos, daniel.garcia, security-team, smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/410665/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1226340

Description Camila Camargo de Matos 2024-06-14 14:04:01 UTC

+++ This bug was initially created as a clone of Bug #1226340 +++

libyaml v0.2.5 is vulnerable to Buffer Overflow. Affected by this issue is the function yaml_emitter_emit of the file /src/libyaml/src/emitter.c. The manipulation leads to a double-free.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35326
https://www.cve.org/CVERecord?id=CVE-2024-35326
https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35326.c
https://bugzilla.redhat.com/show_bug.cgi?id=2292351

Comment 1 Camila Camargo de Matos 2024-06-14 17:11:20 UTC

See bug #1226340 for a reference link which is the upstream GitHub issue where this possible vulnerability is being discussed.

Comment 3 Daniel Garcia 2024-06-18 11:32:22 UTC

Possibly not a bug, upstream discussion can be found here:
https://github.com/yaml/libyaml/issues/298

Comment 4 Daniel Garcia 2024-06-26 09:42:12 UTC

The code snippet uses the API in a wrong way, calling yaml_emitter_emit without initializing the emitter with yaml_emitter_initialize. The correct usage is documented here: https://pyyaml.org/wiki/LibYAML

I've reviewed the embed code in the package and is not affected at all because it is using the API in the correct way. The emitter class initializes the internal yaml emitter in the constructor.