search

cxnleach / Vuln_GO_App

MIT License
0 stars 0 forks source link

CX: CVE-2024-24786 in Go-google.golang.org/protobuf and v1.24.0 @ Vuln_GO_App.master #8

Open github-actions[bot] opened 2 months ago

github-actions[bot] commented 2 months ago

Description

In the package google.golang.org/protobuf versions prior to 1.33.0, the "protojson.Unmarshal" function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a "google.protobuf.Any" value, or when the "UnmarshalOptions.DiscardUnknown" option is set.

HIGH Vulnerable Package issue exists @ google.golang.org/protobuf in branch master

Vulnerability ID: CVE-2024-24786

Package Name: google.golang.org/protobuf

Severity: HIGH

CVSS Score: 7.5

Publish Date: 2024-03-05T23:15:00

Current Package Version: v1.24.0

Remediation Upgrade Recommendation: v1.25.1-0.20210525005349-febffdd88e85

Link To SCA

Reference – NVD link

github-actions[bot] commented 2 months ago

Issue still exists.