PT-2022-17588 · Shoutrrr · Shoutrrr

Justinsteven · Published 2022-07-15 · Updated 2022-07-30 · CVE-2022-25891

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions github.com/containrrr/shoutrrr/pkg/util versions prior to 0.6.0

Description The issue is related to a Denial of Service (DoS) that can be triggered via the util.PartitionMessage function by sending messages of exactly 2000, 4000, or 6000 characters in length. This can cause a panic when sending such a message to Discord.

Recommendations For versions prior to 0.6.0, update to version 0.6.0 or later to resolve the issue. As a temporary workaround, consider disabling the util.PartitionMessage function until a patch is available. Avoid sending messages of exactly 2000, 4000, or 6000 characters in length to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

AZL-31969

CVE-2022-25891

GHSA-477V-W82M-634J

GO-2022-0528

SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059

Affected Products

Shoutrrr

References · 13

• 🔥 https://github.com/containrrr/shoutrrr/issues/240 · Exploit
• https://github.com/containrrr/shoutrrr/commit/6a27056f9d7522a8b493216195cb7634bf4b5c42 · Patch
• https://github.com/containrrr/shoutrrr/pull/242 · Patch
• https://osv.dev/vulnerability/GO-2022-0528 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-31969 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25891 · Vendor Advisory
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25891 · Security Note
• https://osv.dev/vulnerability/GHSA-477v-w82m-634j · Vendor Advisory
• https://github.com/containrrr/shoutrrr/releases/tag/v0.6.0 · Note
• https://github.com/containrrr/shoutrrr · Note
• https://pkg.go.dev/vuln/GO-2022-0528 · Note
• https://t.me/cibsecurity/46373 · Telegram Post