Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in google.golang.org/protobuf/encoding/prototext #1631

Closed
neild opened this issue Mar 14, 2023 · 2 comments
Closed

x/vulndb: potential Go vuln in google.golang.org/protobuf/encoding/prototext #1631

neild opened this issue Mar 14, 2023 · 2 comments
Assignees
@neild
Labels
Direct External Report

Comments

@neild
Copy link
Contributor

neild commented Mar 14, 2023

Description

Parsing invalid messages can panic.

Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

Affected Modules, Packages, Versions and Symbols

Module: google.golang.org/protobuf
Package: google.golang.org/protobuf/encoding/prototext
Versions:
  - Introduced: 1.29.0
  - Fixed: 1.29.1

Does this vulnerability already have an associated CVE ID?

No

CVE ID

No response

Credit

No response

CWE ID

No response

Pull Request

https://go.dev/cl/475995

Commit

No response

References

Additional information

No response
@neild neild self-assigned this Mar 14, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/476098 mentions this issue: data/reports: add GO-2023-1631.yaml

gopherbot pushed a commit that referenced this issue Mar 14, 2023
@neild @gopherbot
data/reports: add GO-2023-1631.yaml
e8b24cf 
Aliases: CVE-2023-24535

Updates #1631

Change-Id: If969c534b888ca71d337a6dc85e691839973488d
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/476098
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
Auto-Submit: Damien Neil <[email protected]>
@GoVulnBot GoVulnBot mentioned this issue Mar 15, 2023
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/476455 mentions this issue: data/reports: update GO-2023-1631.yaml

gopherbot pushed a commit that referenced this issue Mar 15, 2023
@jba
data/reports: update GO-2023-1631.yaml
d2854b6 
add aliases: GHSA-hw7c-3rfg-p46j

Updates #1631

Change-Id: Ic49d5769d5c831af2bfbcd3f4f8e20d2ae4e9b8a
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/476455
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Jonathan Amsterdam <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
@neild neild closed this as completed Jun 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@neild neild

Labels
Direct External Report
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@neild @gopherbot