Описание
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
A heap based buffer overflow exists in the libyaml package such that an attacker by supplying a specially crafted yaml document when parsed by the application might result in remote code execution leading to complete compromise of the system.
Отчет
Redhat satellite does not ship libyaml package but instead consumes the package from the RHEL distribution which is why it has been marked as not affected.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5 | ruby193-libyaml | Not affected | ||
| OpenShift Enterprise 1 | ruby193-libyaml | Will not fix | ||
| Red Hat Enterprise Linux 6 | libyaml | Affected | ||
| Red Hat Enterprise Linux 7 | libyaml | Not affected | ||
| Red Hat Enterprise MRG 1 | libyaml | Will not fix | ||
| Red Hat Enterprise MRG 2 | libyaml | Will not fix | ||
| Red Hat Satellite 5 | libyaml | Not affected | ||
| Red Hat Satellite 6 | libyaml | Not affected | ||
| Red Hat Software Collections | libyaml | Not affected | ||
| Red Hat Subscription Asset Manager | libyaml | Affected |
Показывать по
Дополнительная информация
Статус:
6.8 Medium
CVSS2
Связанные уязвимости
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes functio ...
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
Уязвимость операционной системы Gentoo Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
6.8 Medium
CVSS2