« Volver al listado

CVE-2021-4235

Estado: ModificadaMedia (5.5)—

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yaml Project — Yaml

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-4235",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-4235",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-11T16:24:34.544009Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "gopkg.in/yaml.v2",
          "product": "gopkg.in/yaml.v2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.2.3",
              "versionType": "semver"
            }
          ],
          "packageName": "gopkg.in/yaml.v2",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "decoder.unmarshal"
            },
            {
              "name": "Decoder.Decode"
            },
            {
              "name": "Unmarshal"
            },
            {
              "name": "UnmarshalStrict"
            }
          ]
        },
        {
          "vendor": "github.com/go-yaml/yaml",
          "product": "github.com/go-yaml/yaml",
          "packageName": "github.com/go-yaml/yaml",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "affected",
          "programRoutines": [
            {
              "name": "decoder.unmarshal"
            },
            {
              "name": "Decoder.Decode"
            },
            {
              "name": "Unmarshal"
            },
            {
              "name": "UnmarshalStrict"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-27T22:15:11.960",
  "references": [
    {
      "url": "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://github.com/go-yaml/yaml/pull/375",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html",
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2021-0061",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/go-yaml/yaml/pull/375",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2021-0061",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector."
    },
    {
      "lang": "es",
      "value": "Debido a la búsqueda ilimitada de alias, un archivo YAML creado con fines malintencionados puede hacer que el sistema consuma importantes recursos. Si se analiza la entrada del usuario, esto se puede utilizar como un vector de denegación de servicio."
    }
  ],
  "lastModified": "2026-06-17T04:19:19.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yaml_project:yaml:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6ADB4662-19BA-4FB2-88FB-0D8309DE5DB0",
              "versionEndExcluding": "2.2.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}