CVE-2022-28948 @ Go-gopkg.in/yaml.v3-v3.0.0-20210107192922-496545a6307b #101
Description
Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2022-28948
Applications: yael's application
Checkmarx Project: Yoavast/CX-AST
Repository URL: https://github.com/Yoavast/CX-AST
Branch: main
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Scan ID: b70b7227-90db-4075-88cb-4c196077be97
An issue in the "Unmarshal" function in gopkg.in/yaml.v3 and github.com/go-yaml/yaml versions prior to v3.0.0-20220521103104-8f96da9f5d5e causes the program to crash when attempting to deserialize invalid input.
Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: HIGH
Remediation Upgrade Recommendation: v3.0.1