Bug 1199772 - (CVE-2022-28948) VUL-0: CVE-2022-28948: rook: An issue during unmarshaling in Go-Yaml v3 can lead to DoS via invalid input
(CVE-2022-28948)
VUL-0: CVE-2022-28948: rook: An issue during unmarshaling in Go-Yaml v3 can l...
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: E-Mail List
Security Team bot
https://smash.suse.de/issue/332407/
CVSSv3.1:SUSE:CVE-2022-28948:5.5:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-05-20 12:56 UTC by Carlos López
Modified: 2022-08-12 14:03 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2022-05-20 12:56:12 UTC
CVE-2022-28948

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash
when attempting to deserialize invalid input.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-28948
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28948
https://github.com/go-yaml/yaml/issues/666
Comment 1 Carlos López 2022-05-20 12:57:03 UTC
rook embeds go-yaml.v3 in the following codestreams:
 - SUSE:SLE-15-SP2:Update:Products:SES7:Update
 - SUSE:SLE-15-SP3:Update:Products:SES7:Update
 - openSUSE:Backports:SLE-15-SP4
 - openSUSE:Factory

On SUSE:SLE-15-SP1:Update:Products:SES6:Update and openSUSE:Backports:SLE-15-SP3 only yaml.v2 is embedded, which does not seem to be affected.