CVE-2024-24786

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

Published Mar 5, 2024 CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Description
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-0879 The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Github GHSA Github GHSA GHSA-8r3f-844c-mc37 Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
Ubuntu USN Ubuntu USN USN-6746-1 Google Guest Agent and Google OS Config Agent vulnerability
Ubuntu USN Ubuntu USN USN-6746-2 Google Guest Agent and Google OS Config Agent vulnerability
History
Type Values Removed Values Added
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go
Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:8.1::el9
Vendors & Products Redhat ceph Storage
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.18::el9
Type Values Removed Values Added
First Time appeared Redhat openshift Ai
CPEs cpe:/a:redhat:openshift_ai:2.16::el8
cpe:/a:redhat:openshift_serverless:1.35::el8
Vendors & Products Redhat openshift Ai
Type Values Removed Values Added
First Time appeared Golang
Golang go
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.17::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:run_once_duration_override_operator:1.2::el9
Type Values Removed Values Added
First Time appeared Redhat cluster Observability Operator
CPEs cpe:/a:redhat:cluster_observability_operator:0.4::el8
Vendors & Products Redhat cluster Observability Operator
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
Type Values Removed Values Added
First Time appeared Redhat openshift Builds
CPEs cpe:/a:redhat:openshift_builds:1.1::el9
Vendors & Products Redhat openshift Builds