CVE-2021-3121
An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" is...
Summary
Improper Input Validation in GoGo Protobuf
Original description
The description as published by the source.
An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.15"},{"introduced":"1.9.0"},{"fixed":"1.9.9"},{"introduced":"1.10.0"},{"fixed":"1.10.2"}]}]
Go
github.com/gogo/protobuf
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]
Bitnami
protobuf
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2021-3121 protobuf-c Fixed in: 1.3.2-r0
- Debian DEBIAN-CVE-2021-3121 golang-gogoprotobuf Fixed in: 1.3.2-1
References
- advisory discuss.hashicorp.com
- advisory github.com
- advisory github.com
- advisory security.netapp.com
- package github.com
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web nvd.nist.gov
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web pkg.go.dev
- web security.netapp.com