Lucene search

[email protected]CVE-2020-5234

HistoryJan 31, 2020 - 6:15 p.m.

CVE-2020-5234

2020-01-3118:15:11

CWE-787

CWE-121

[email protected]

web.nvd.nist.gov

cve-2020-5234

messagepack

unity

vulnerability

dos attack

github security advisory

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.01 Low

EPSS

Percentile

83.9%

JSON

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

Affected configurations

Vulners

NVD

Node

neueccmessagepackRange<1.9.11

neueccmessagepackRange2.0.0–2.1.90

neueccmessagepack.immutablecollectionRange<1.9.11

neueccmessagepack.immutablecollectionRange2.0.0–2.1.90

neueccmessagepack.reactivepropertyRange<1.9.11

neueccmessagepack.reactivepropertyRange2.0.0–2.1.90

neueccmessagepack.unityshimsRange<1.9.11

neueccmessagepack.unityshimsRange2.0.0–2.1.90

CPENameOperatorVersion
messagepack:messagepackmessagepacklt1.9.3
messagepack:messagepackmessagepacklt2.1.80
messagepack:messagepackmessagepackeq2.0.94
messagepack:messagepackmessagepackeq2.0.110
messagepack:messagepackmessagepackeq2.0.119
messagepack:messagepackmessagepackeq2.0.123
messagepack:messagepackmessagepackeq2.0.204
messagepack:messagepackmessagepackeq2.0.270
messagepack:messagepackmessagepackeq2.0.299

CPE	Name	Operator	Version
messagepack:messagepack	messagepack	lt	1.9.3
messagepack:messagepack	messagepack	lt	2.1.80
messagepack:messagepack	messagepack	eq	2.0.94
messagepack:messagepack	messagepack	eq	2.0.110
messagepack:messagepack	messagepack	eq	2.0.119
messagepack:messagepack	messagepack	eq	2.0.123
messagepack:messagepack	messagepack	eq	2.0.204
messagepack:messagepack	messagepack	eq	2.0.270
messagepack:messagepack	messagepack	eq	2.0.299

CNA Affected

[
  {
    "product": "MessagePack",
    "vendor": "neuecc",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.9.11"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.1.90"
      }
    ]
  },
  {
    "product": "MessagePack.ImmutableCollection",
    "vendor": "neuecc",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.9.11"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.1.90"
      }
    ]
  },
  {
    "product": "MessagePack.ReactiveProperty",
    "vendor": "neuecc",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.9.11"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.1.90"
      }
    ]
  },
  {
    "product": "MessagePack.UnityShims",
    "vendor": "neuecc",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.9.11"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.1.90"
      }
    ]
  }
]

References

github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02

github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007

github.com/neuecc/MessagePack-CSharp/issues/810

github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.01 Low

EPSS

Percentile

83.9%

JSON

Related for CVE-2020-5234

osv2 prion1 github1 veracode1 cvelist1 nvd1