Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/protocolbuffers/protobuf: CVE-2024-2410 #2810

Closed
GoVulnBot opened this issue May 3, 2024 · 2 comments
Closed

x/vulndb: potential Go vuln in github.com/protocolbuffers/protobuf: CVE-2024-2410 #2810

GoVulnBot opened this issue May 3, 2024 · 2 comments
Assignees
@tatianab
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module.

Comments

@GoVulnBot
Copy link

CVE-2024-2410 references github.com/protocolbuffers/protobuf, which may be a Go module.

Description:
The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already been freed. 

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/protocolbuffers/protobuf
      vulnerable_at: 5.26.1+incompatible
      packages:
        - package: protobuf
summary: CVE-2024-2410 in github.com/protocolbuffers/protobuf
cves:
    - CVE-2024-2410
references:
    - web: https://github.com/protocolbuffers/protobuf/releases/tag/v25.0
source:
    id: CVE-2024-2410
@tatianab tatianab self-assigned this May 3, 2024
@tatianab tatianab added the excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. label May 3, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/584376 mentions this issue: data/excluded: batch add 3 excluded reports

@tatianab tatianab added possibly not Go and removed excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. labels May 14, 2024
@tatianab tatianab added excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. and removed possibly not Go labels Jun 5, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/590855 mentions this issue: data/excluded: add 20 excluded reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tatianab tatianab

Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot