5

CVE-2014-9130: pyyaml libyaml Improper Input Validation

CVSS: 5.0v2.0MediumModified
AliasesALPINE-CVE-2014-9130MGASA-2014-0508MGASA-2015-0004
Published 08-12-2014Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2014-9130 is a medium (CVSS 5.0) Improper Input Validation vulnerability in pyyaml libyaml. EPSS estimates a 13.20% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.0/10
010
Medium · v2.0 (NVD)
EPSS score
13.20%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
OPENSUSE-SU-2024:10029-1OPENSUSE-SU-2024:10520-1SUSE-SU-2015:0953-1SUSE-SU-2015:0953-2

Timeline

  1. 08-12-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

13.20%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 13.20% on 20-09-2026

20-09-202620-10-2026
EPSS score
13.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (bitbucket.org)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (bitbucket.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse4 products
  • python-PyYAML&distro=SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5< 3.10-15.1
  • python-PyYAML&distro=SUSE Enterprise Storage 1.0< 3.10-15.1
  • python-PyYAML&distro=SUSE Linux Enterprise High Availability Extension 12< 3.10-15.1
  • python-PyYAML&distro=SUSE Linux Enterprise Module for Public Cloud 12< 3.10-15.1
Debian3 products
  • libyaml< 0.1.6-3 | < 0.1.3-1+deb6u5 | < 0.1.4-2+deb7u5
  • libyaml-libyaml-perl< 0.41-6 | < 0.33-1+squeeze4 | < 0.38-3+deb7u3
  • pyyaml< 3.11-2 | < 3.09-5+deb6u1 | < 3.10-4+deb7u1
Mageia3 products
  • perl-YAML-LibYAML< 0.410.0-2.3.mga4
  • python-yaml< 3.10-5.1.mga4
  • yaml< 0.1.6-1.1.mga4
Redhat3 products
  • libyaml< 0:0.1.3-4.el6_6 | < 0:0.1.4-11.el7_0
  • libyaml-debuginfo< 0:0.1.3-4.el6_6 | < 0:0.1.4-11.el7_0
  • libyaml-devel< 0:0.1.3-4.el6_6 | < 0:0.1.4-11.el7_0
Ubuntu3 products
  • libyaml< 0.1.4-3ubuntu3.1
  • libyaml-libyaml-perl< 0.41-5ubuntu0.14.04.1
  • pyyaml< 3.10-4ubuntu0.1
Alpine1 product
  • yaml< 0.1.6-r1
Pyyaml1 product

7 vendors · 18 products

References

57 links
Show all 57 references