GO-2021-0142
Unbounded read from invalid inputs in encoding/binary
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2020-16845
- Alias
- BIT-golang-2020-16845, GHSA-q6gq-997w-f55g
Description
ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs. Certain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input than expected when the caller is reading directly from a network and depends on ReadUvarint or ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.13.15, introduced 1.14.0-0, fixed 1.14.7 |
Références
- https://go.dev/cl/247120 FIX
- https://go.googlesource.com/go/+/027d7241ce050d197e7fabea3d541ffbe3487258 FIX
- https://go.dev/issue/40618 REPORT
- https://groups.google.com/g/golang-announce/c/NyPIaucMgXo WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |