spumko/yar · Security
Denial of Service in yar
- GHSA ID
- GHSA-gg6m-fhqv-hg56
- CVE ID
- CVE-2014-4179
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Versions of yar prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value.
When an invalid encryped session cookie value is provided, the process will crash.
Recommendation
Update to version 2.2.0 or later.
CWEs
- CWE-400 · Uncontrolled Resource Consumption