Security Advisories

CGA-p836-mcw8-43j4

Published

Last updated

https://images.chainguard.dev/security/CGA-p836-mcw8-43j4

Package

k3d

Latest Update

Fixed

Fixed Version

5.6.0-r11

Aliases

CVE-2021-4235
GHSA-r88r-gmrh-7j83

Severity

5.5

Medium

CVSS V3

Summary

YAML Go package vulnerable to denial of service

Description

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-4235
https://github.com/advisories/GHSA-r88r-gmrh-7j83
https://github.com/go-yaml/yaml/pull/375
https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241
https://github.com/go-yaml/yaml
https://pkg.go.dev/vuln/GO-2021-0061

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CGA-p836-mcw8-43j4

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources