x/vulndb: potential Go vuln in github.com/contribsys/faktory: CVE-2023-37279

[GoVulnBot]

CVE-2023-37279 references github.com/contribsys/faktory, which may be a Go module.

Description:
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-37279
• JSON: https://github.com/CVEProject/cvelist/tree/5cd06778b6f419307994ea8903fb51225445aab5/2023/37xxx/CVE-2023-37279.json
• advisory: GHSA-x4hh-vjm7-g2jv
• Imported by: https://pkg.go.dev/github.com/contribsys/faktory?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/contribsys/faktory
      vulnerable_at: 1.8.0
      packages:
        - package: faktory
description: |-
    Faktory is a language-agnostic persistent background job server. Prior to
    version 1.8.0, the Faktory web dashboard can suffer from denial of service by a
    crafted malicious url query param `days`. The vulnerability is related to how
    the backend reads the `days` URL query parameter in the Faktory web dashboard.
    The value is used directly without any checks to create a string slice. If a
    very large value is provided, the backend server ends up using a significant
    amount of memory and causing it to crash. Version 1.8.0 fixes this issue.
cves:
    - CVE-2023-37279
references:
    - advisory: https://github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jv

[zpavlinovic]

Vulnerability in tool. Although some packages indeed seem to be imported, the issue seems be in the webui package that is never imported, yet only cloned.

[gopherbot]

Change https://go.dev/cl/530118 mentions this issue: data/excluded: batch add 7 excluded reports

[gopherbot]

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606791 mentions this issue: data/reports: unexclude 20 reports (11)