CVE-2022-28948

Name	CVE-2022-28948
Description	An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1011338

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-gopkg-yaml.v3 (PTS)	bookworm, trixie	3.0.1-3	fixed
	forky, sid	3.0.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-gopkg-yaml.v3	source	(unstable)	3.0.1-1			1011338

Notes

[bullseye] - golang-gopkg-yaml.v3 <no-dsa> (Minor issue)
https://github.com/go-yaml/yaml/issues/666
https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf6754 (v3.0.0)