PT-2020-6441 · Unknown+4 · Gogo Protobuf+4
Hrsakai
·
Published
2020-08-07
·
Updated
2025-08-25
·
CVE-2021-3121
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
GoGo Protobuf versions prior to 1.3.2
Description
The issue is related to improper index validation in the
unmarshal.go file of the GoGo Protobuf library, which can lead to an out-of-bounds panic when parsing maliciously crafted input. This may be used as a denial of service vector if messages are parsed from untrusted parties. The issue affects the confidentiality, integrity, and availability of protected information.Recommendations
For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
Unmarshal methods when parsing messages from untrusted parties to minimize the risk of exploitation.Fix
Improper Validation of Array Index
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Gogo Protobuf
Hashicorp Consul
Suse