VDB
RHSA-2023%3A0570
RHSA-2023%3A0570
PUBLISHED
CVSS 5.5 MEDIUM
A flaw was found in go-yaml. This issue occurs due to unbounded alias chasing, where a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-service-idler-rhel8@sha256:da6e2ce9155c554bc9b5eed3df31a37619829caa73437a89abb030a1cb9c8588_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-service-idler-rhel8@sha256:aff87e036b30780ebb036099fd280b37ee0e0fdfb0a4c187f930fb1029aa559a_s390x as a component of Red Hat OpenShift Container Platform 4.12 | *, openshift4/ose-service-idler-rhel8@sha256:aff87e036b30780ebb036099fd280b37ee0e0fdfb0a4c187f930fb1029aa559a_s390x |
| Red Hat | openshift4/ose-operator-sdk-rhel8@sha256:3080d6195d66b8d770fedb2074c92671198cb63b2b87a944a67c3d2e2cf0eb28_s390x as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-operator-sdk-rhel8@sha256:3080d6195d66b8d770fedb2074c92671198cb63b2b87a944a67c3d2e2cf0eb28_s390x, * |
| Red Hat | openshift4/kubernetes-nmstate-rhel8-operator@sha256:4a2fc00d3e9465563d969f90fddb522110d580317203ab0d10194fc4e02f173f_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/kubernetes-nmstate-rhel8-operator@sha256:4a2fc00d3e9465563d969f90fddb522110d580317203ab0d10194fc4e02f173f_ppc64le |
| Red Hat | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:bd910ece9b40b8dc9c786d8c7e0e267d0aaef631c36188592abd5e14f2b8a9ed_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:bd910ece9b40b8dc9c786d8c7e0e267d0aaef631c36188592abd5e14f2b8a9ed_arm64 |
| Red Hat | openshift4/ose-operator-sdk-rhel8@sha256:1a0984339e315355c08d1361f59fabded166c35dc58d1b7d77dba9053f09e5b1_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | openshift4/ose-operator-sdk-rhel8@sha256:c78af94a2222275bee746a281accf22a809aff614d6f78882f3876cc7d9d3f0b_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-operator-sdk-rhel8@sha256:c78af94a2222275bee746a281accf22a809aff614d6f78882f3876cc7d9d3f0b_ppc64le, * |
| Red Hat | openshift4/ose-local-storage-mustgather-rhel8@sha256:f364b5a8ee56e0a807d095ab10f4adb40d904a8ccdaf77981828021a37856765_s390x as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-local-storage-mustgather-rhel8@sha256:f364b5a8ee56e0a807d095ab10f4adb40d904a8ccdaf77981828021a37856765_s390x, * |
| Red Hat | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:290c1e6cf50c45f9a211319137feaff10827e676660381c0ddc572fee5e61854_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:290c1e6cf50c45f9a211319137feaff10827e676660381c0ddc572fee5e61854_amd64 |
| Red Hat | openshift4/kubernetes-nmstate-rhel8-operator@sha256:149e387685d4f40bba9f92fc1781a261811966532bee1624ea4a38a36f1a76b5_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | openshift4/ose-operator-sdk-rhel8@sha256:0dc985bfd60b4239d9f499605d6dcee12632f2f8635ede979d722b7f78b42db6_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | openshift4/ose-operator-sdk-rhel8@sha256:c78af94a2222275bee746a281accf22a809aff614d6f78882f3876cc7d9d3f0b_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-operator-sdk-rhel8@sha256:c78af94a2222275bee746a281accf22a809aff614d6f78882f3876cc7d9d3f0b_ppc64le |
| Red Hat | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:a1879955314f51cf628a9c87ff763cae1502e5ef64c3de9bf6c80c811ab9c44c_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:a1879955314f51cf628a9c87ff763cae1502e5ef64c3de9bf6c80c811ab9c44c_arm64 |
| Red Hat | openshift4/ose-local-storage-mustgather-rhel8@sha256:f364b5a8ee56e0a807d095ab10f4adb40d904a8ccdaf77981828021a37856765_s390x as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-local-storage-mustgather-rhel8@sha256:f364b5a8ee56e0a807d095ab10f4adb40d904a8ccdaf77981828021a37856765_s390x |
| Red Hat | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:6fc0b4c0b21c344d2d3f8795472ca83a6532f386ebbcdc166e1edc644b107d46_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:6fc0b4c0b21c344d2d3f8795472ca83a6532f386ebbcdc166e1edc644b107d46_amd64, * |
| Red Hat | openshift4/ose-service-idler-rhel8@sha256:cb575d2e20cf49263524dc83424d40bf4fb8652671c44e8470ff32cf279942db_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-service-idler-rhel8@sha256:cb575d2e20cf49263524dc83424d40bf4fb8652671c44e8470ff32cf279942db_arm64 |
| Red Hat | openshift4/metallb-rhel8-operator@sha256:1d27073493ffab3bc39f49f10f64aec5bdc5f6616c109a61269419fd6e4ca8dd_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/metallb-rhel8-operator@sha256:1d27073493ffab3bc39f49f10f64aec5bdc5f6616c109a61269419fd6e4ca8dd_amd64, * |
| Red Hat | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:a1879955314f51cf628a9c87ff763cae1502e5ef64c3de9bf6c80c811ab9c44c_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:a1879955314f51cf628a9c87ff763cae1502e5ef64c3de9bf6c80c811ab9c44c_arm64, * |
| Red Hat | openshift4/ose-operator-sdk-rhel8@sha256:3080d6195d66b8d770fedb2074c92671198cb63b2b87a944a67c3d2e2cf0eb28_s390x as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-operator-sdk-rhel8@sha256:3080d6195d66b8d770fedb2074c92671198cb63b2b87a944a67c3d2e2cf0eb28_s390x |
| Red Hat | openshift4/ose-service-idler-rhel8@sha256:30aca1c4ae3866b7eab74f02d584a0330a1016eaee48a0516ab3a45dbc0f01d1_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-service-idler-rhel8@sha256:30aca1c4ae3866b7eab74f02d584a0330a1016eaee48a0516ab3a45dbc0f01d1_amd64 |
…and 44 more
Timeline
- Feb 7, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 4, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:0570 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2156727 issue
- https://issues.redhat.com/browse/OCPBUGS-5526 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0570.json advisory
- https://access.redhat.com/security/cve/CVE-2021-4235 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-4235 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-4235 advisory
- https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241 advisory
- https://github.com/go-yaml/yaml/pull/375 advisory
- https://pkg.go.dev/vuln/GO-2021-0061 advisory