[USN-6287-1] Go yaml vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6287-1
August 14, 2023
golang-yaml.v2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were patched in the Go yaml package.
Software Description:
- golang-yaml.v2: YAML support for the Go language
Details:
Simon Ferquel discovered that the Go yaml package incorrectly handled
certain YAML documents. If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause the system to crash, resulting in
a denial of service. (CVE-2021-4235)
It was discovered that the Go yaml package incorrectly handled
certain large YAML documents. If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause the system to crash, resulting in
a denial of service. (CVE-2022-3064)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
golang-gopkg-yaml.v2-dev 2.2.2-1ubuntu0.1
golang-yaml.v2-dev 2.2.2-1ubuntu0.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
golang-gopkg-yaml.v2-dev 0.0+git20170407.0.cd8b52f-1ubuntu2+esm1
golang-yaml.v2-dev 0.0+git20170407.0.cd8b52f-1ubuntu2+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
golang-yaml.v2-dev 0.0+git20160301.0.a83829b-1ubuntu0.1~esm1
After a standard system update anything that depends on golang-yaml.v2 needs
to be rebuilt to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6287-1
CVE-2021-4235, CVE-2022-3064
Package Information:
https://launchpad.net/ubuntu/+source/golang-yaml.v2/2.2.2-1ubuntu0.1
A Go yaml security update has been released for Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS.
