CVE-2024-24786

🗓️ 06 Mar 2024 07:12:54Reported by redhat.comType

redhatcve

redhatcve🔗 access.redhat.com👁 164 Views

Flaw in Golang protobuf module causes infinite loop on unmarshal function with certain input

Reporter	Title	Published	Views	Family All 1074
RedHat Linux	Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.42 security and extras update	23 May 202406:22	–	redhat
RedHat Linux	Low: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update	23 May 202414:09	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: container-tools:rhel8 security update	22 May 202411:48	–	redhat
RedHat Linux	golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON	22 May 202411:48	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update	23 May 202406:39	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9	1 Jul 202400:52	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update	5 Jun 202405:15	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update	5 Jun 202414:47	–	redhat
RedHat Linux	golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON	5 Jun 202414:47	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update	5 Jun 202414:47	–	redhat

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-24786
go	www.go.dev/cl/569356
groups	www.groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/
pkg	www.pkg.go.dev/vuln/GO-2024-2611
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

03 Oct 2024 12:03Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.9

EPSS0.01262

golang protobuf module infinite loop unmarshal function invalid inputs google.protobuf.any unmarshaloptions.discardunknown denial of service