CVE-2021-3121 | github.com/gogo/protobuf:v1.3.0 (CWE-20)

[cbilgin23]

Due Date: 2022-09-30

A high severity vulnerability has been discovered in your project.

Project Name: test

Scanner Name: dependabot

Cwe ID: 20

Cwe Name: Improper Input Validation

Cwe Link: https://cwe.mitre.org/data/definitions/20.html

File: go.sum

Packages:

• github.com/gogo/protobuf:v1.3.0

References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-3121
• https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
• https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
• https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
• https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
• https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
• https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
• https://security.netapp.com/advisory/ntap-20210219-0006/
• https://github.com/advisories/GHSA-c3h9-896r-86jm

Training(Secure Code Warrior):

• Name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

• Description: The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

• Link: https://portal.securecodewarrior.com/?utm_source=partner-integration:kondukto#/contextual-microlearning/web/injection

• Videos:

---

• Name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

• Description: The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

• Link: https://portal.securecodewarrior.com/?utm_source=partner-integration:kondukto#/contextual-microlearning/web/injection/sql/go/vanilla

• Videos:

  • https://media.securecodewarrior.com/v2/module_01_sql_injection.mp4

    ---

Tool Description: Summary: Improper Input Validation in GoGo Protobuf. Description: An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

Kondukto Link: http://80.kondukto.local/projects/6331ad74ef14f4953e572991/vulns/appsec?page=1&perPage=15&id=in:63369976ac49fe7403108cf8