SUSE-SU-2022:1073-1

Details

This update for yaml-cpp fixes the following issues:

CVE-2018-20573: Fixed remote DOS via a crafted YAML file in function Scanner:EnsureTokensInQueue (bsc#1121227).
CVE-2018-20574: Fixed remote DOS via a crafted YAML file in function SingleDocParser:HandleFlowMap (bsc#1121230).
CVE-2019-6285: Fixed remote DOS via a crafted YAML file in function SingleDocParser::HandleFlowSequence (bsc#1122004).
CVE-2019-6292: Fixed DOS by stack consumption in singledocparser.cpp (bsc#1122021).

Affected Packages

libyaml-cpp0_6

SUSE Linux Enterprise Installer Updates 15 SP2SUSE Linux Enterprise Micro 5.0SUSE Linux Enterprise Micro 5.1SUSE Linux Enterprise Module for Basesystem 15 SP3SUSE Linux Enterprise Real Time 15 SP2

Fixed in:

0.6.1-4.5.1

yaml-cpp

SUSE Linux Enterprise Installer Updates 15 SP2SUSE Linux Enterprise Micro 5.0SUSE Linux Enterprise Micro 5.1SUSE Linux Enterprise Module for Basesystem 15 SP3SUSE Linux Enterprise Module for Desktop Applications 15 SP3

Fixed in:

0.6.1-4.5.1

yaml-cpp-devel

SUSE Linux Enterprise Module for Desktop Applications 15 SP3SUSE Linux Enterprise Real Time 15 SP2

Fixed in:

0.6.1-4.5.1

References

REPORT

https://bugzilla.suse.com/1121227

REPORT

https://bugzilla.suse.com/1121230

REPORT