CVE-2012-1152 Denial of service in n/a
Remote attackers can crash the application via format string specifiers in YAML input processed by the Perl YAML::LibYAML module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-1152?
CVE-2012-1152 is a medium-severity denial of service vulnerability in n/a, published on 9 Sep 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function.
Weakness: CWE-134
Which versions are affected by CVE-2012-1152?
It affects 1 product.
Products include Ingy Yaml\.
How do I fix CVE-2012-1152?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2012-1152 being exploited?
There is no known exploitation of CVE-2012-1152 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2012-1152, DSA-2432-1, GHSA-3h7q-h379-g658.