CVE-2024-24786 Infinite loop in JSON unmarshaling in google.golang.org/protobuf

🗓️ 05 Mar 2024 22:22:35Reported by GoType

Infinite loop in JSON unmarshaling in google.golang.org/protobuf due to invalid JSON forms and google.protobuf.Any value

Reporter	Title	Published	Views	Family All 1076
RedhatCVE	CVE-2024-24786	6 Mar 202407:12	–	redhatcve
RedHat Linux	Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.57 security update	16 May 202416:12	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.42 security and extras update	23 May 202406:22	–	redhat
RedHat Linux	Low: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update	23 May 202414:09	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: container-tools:rhel8 security update	22 May 202411:48	–	redhat
RedHat Linux	golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON	22 May 202411:48	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update	23 May 202406:39	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9	1 Jul 202400:52	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update	5 Jun 202405:15	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update	5 Jun 202414:47	–	redhat

[
  {
    "vendor": "google.golang.org/protobuf",
    "product": "google.golang.org/protobuf/encoding/protojson",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "google.golang.org/protobuf/encoding/protojson",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.33.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "UnmarshalOptions.unmarshal"
      },
      {
        "name": "Unmarshal"
      },
      {
        "name": "UnmarshalOptions.Unmarshal"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "google.golang.org/protobuf",
    "product": "google.golang.org/protobuf/internal/encoding/json",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "google.golang.org/protobuf/internal/encoding/json",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.33.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Decoder.Read"
      },
      {
        "name": "Decoder.Peek"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
security	www.security.netapp.com/advisory/ntap-20240517-0002/
openwall	www.openwall.com/lists/oss-security/2024/03/08/4
pkg	www.pkg.go.dev/vuln/GO-2024-2611
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/
go	www.go.dev/cl/569356

10 Jun 2024 17:12Current

6.2Medium risk

Vulners AI Score6.2

EPSS0.01262