PT-2023-9033 · Msgpackr+1 · Msgpack+1
O5K
·
Publicado
2023-12-28
·
Atualizado
2024-04-18
·
CVE-2023-52079
CVSS v3.1
6.8
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
msgpackr versions prior to 1.10.1
Description
The issue is related to the decoding of user-supplied MessagePack messages, which can cause threads to become stuck in a loop. This can be triggered by crafting specific messages. Exploits seem to require structured cloning. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.
Recommendations
For versions prior to 1.10.1, update to version 1.10.1 to resolve the issue.
As a temporary workaround, consider replacing the 0x70 extension with a custom one that throws an error or does something other than recursive referencing to mitigate the issue.
Exploit
Correção
Improper Check for Exceptional Conditions
Uncontrolled Recursion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Red Os
Msgpack