Skip to main content

Inefficient Algorithmic Complexity in js-yaml

Cx0e1b35ca-f68b

  • js-yaml
High
7.5/10

Summary

"resolveYamlOmap()" enforces key uniqueness for !!omap sequences with a linear scan (objectKeys.indexOf(...)) inside the per-element loop, making resolution O(n2) in the number of entries. A modestly sized YAML document therefore consumes disproportionate CPU inside "yaml.load()", giving a denial of service against any consumer that parses untrusted YAML.!!omap is registered in the default schema (lib/schema/default.js - require('../type/omap')), so a plain "yaml.load(untrustedInput)" with no options is affected -- no custom schema or non-default configuration is required. Versions 3.0.0 prior to 3.15.1 and 4.0.0 prior to 4.3.1 are affected.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-407 - Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References

Advisory Timeline

  • Published