Question 1

Is there a bug in serde_yaml 0.6.0-rc1?

Accepted Answer

Uncontrolled recursion leads to abort in deserialization Affected versions of this crate did not properly check for recursion
while deserializing aliases.

This allows an attacker to make a YAML file with an alias referring
to itself causing an abort.

The flaw was corrected by checking the recursion depth. Fixed in serde_yaml 0.8.4.

Question 2

Is there a bug in serde_yaml 0.6.0-rc1?

Accepted Answer

Uncontrolled recursion leads to abort in deserialization Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.
 Fixed in serde_yaml 0.8.4.

Severity	Affected	Fixed in	Title	Status	Source
medium	0.6.0-rc1	0.8.4	Uncontrolled recursion leads to abort in deserialization Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.	fixed	osv:RUSTSEC-2018-0005
medium	0.6.0-rc1	0.8.4	Uncontrolled recursion leads to abort in deserialization Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.	fixed	osv:GHSA-39vw-qp34-rmwf

serde_yaml known bugs