[GHSA-52cp-r559-cp3m] js-yaml: YAML merge-key chains can force quadratic CPU consumption

[tijuks]

Updates

• Affected products
• CVSS v3

Comments
Uncontrolled Resource Consumption (CWE-400)
Inefficient Algorithmic Complexity (CWE-407)

[github]

Hi there @puzrin! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[puzrin]

Field fixed 4.3.3 looks strange. Last release of v4 is 4.3.1 https://github.com/nodeca/js-yaml/commits/v4/

The proposed CVSS vector looks strange too and does not appear to match the vulnerability. This is a CPU resource-exhaustion issue, so C:H, I:H, and S:C seem unjustified: the vulnerability does not disclose or modify data, nor does it cross a security boundary. The changes to AV:A, PR:H, and UI:R are also unclear and are not explained in the PR.

Could you clarify the reasoning behind this vector? The current C:N/I:N/A:H impact appears to describe the issue more accurately.

[tijuks]

severity