PT-2022-28297 · Go · Encoding/Binary

Published 2022-01-13 · Updated 2022-01-13

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned, so the information cannot be provided.

Description The issue arises from certain invalid inputs to ReadUvarint or ReadVarint functions, which could cause them to read an unlimited number of bytes from the ByteReader argument before returning an error. This could lead to processing more input than expected, particularly when reading directly from a network and relying on these functions to consume only a small, bounded number of bytes, even from invalid inputs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GO-2021-0225

Affected Products

Encoding/Binary

References · 5

• https://osv.dev/vulnerability/GO-2021-0225 · Vendor Advisory
• https://go.googlesource.com/go/+/027d7241ce050d197e7fabea3d541ffbe3487258 · Note
• https://go.dev/cl/247120 · Note
• https://go.dev/issue/40618 · Note
• https://groups.google.com/g/golang-announce/c/NyPIaucMgXo · Note