Uncontrolled recursion leads to abort in deserialization
Moderate severity
GitHub Reviewed
Published
Aug 25, 2021
to the GitHub Advisory Database
•
Updated Jun 13, 2023
Description
Reviewed
Aug 6, 2021
Published to the GitHub Advisory Database
Aug 25, 2021
Last updated
Jun 13, 2023
Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.
References