Potential memory exhaustion attack due to sparse slice deserialization
Résumé
Potential memory exhaustion attack due to sparse slice deserialization
Description d'origine
La description telle que publiée par la source (souvent en anglais).
gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-37298 golang-github-gorilla-schema
- Ubuntu UBUNTU-CVE-2024-37298 golang-github-gorilla-schema
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com