CVE-2024-35329

Publication date 11 June 2024

Last updated 4 August 2025

Ubuntu priority

Medium

Why this priority?

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Read the notes from the security team

Status

Package Ubuntu Release Status
libyaml 24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic Ignored end of life, was deferred [2024-06-19]
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected
libyaml-libyaml-perl 24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic Ignored end of life, was deferred [2024-06-19]
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected
golang-goyaml 24.10 oracular Not in release
24.04 LTS noble Not in release
23.10 mantic Not in release
22.04 LTS jammy Not in release
20.04 LTS focal Not in release
16.04 LTS xenial
Not affected
golang-yaml.v2 24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic Ignored end of life, was deferred [2024-06-19]
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes

jdstrand

golang-goyaml is a go translation of libyaml and shouldn't share implementation flaws, but may share design flaws

mdeslaur

Per upstream developers, the PoC code is wrong and they will request that the CVE be rejected. This has now been rejected, marking as not-affected