PT-2021-12083 · Revel · Revel

Sym01 · Published 2021-04-14 · Updated 2023-01-06 · CVE-2020-36568

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: revel versions prior to 1.0.0

Description: The issue is caused by unsanitized input in the query parser, allowing remote attackers to cause resource exhaustion via memory allocation. An attacker can manipulate the request query sent to an application that accepts slice parameters, such as those described at https://revel.github.io/manual/parameters.html#slices, to allocate large amounts of memory and crash the application.

Recommendations: For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to slice parameters to minimize the risk of exploitation. Avoid using slice parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2020-36568

GHSA-HGGR-P7V6-73P5

GO-2020-0003

Affected Products

Revel

References · 16

• 🔥 https://github.com/revel/revel/issues/1424 · Exploit
• https://github.com/revel/revel/commit/d160ecb72207824005b19778594cbdc272e8a605 · Patch
• https://ubuntu.com/security/CVE-2020-36568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36568 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-36568 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36568 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36568 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2020-0003 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hggr-p7v6-73p5 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36568 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36568 · Vendor Advisory
• https://github.com/revel/revel/pull/1427 · Note
• https://github.com/revel/revel · Note
• https://t.me/cibsecurity/55444 · Telegram Post
• https://pkg.go.dev/vuln/GO-2020-0003 · Note