PT-2025-11378 · Unknown · Square Wire

Published 2025-03-16 · Updated 2025-03-16 · CVE-2024-58103

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Square Wire versions prior to 5.2.0

Description: The issue is related to the lack of recursion limit enforcement on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt. This could potentially lead to issues when processing certain data.

Recommendations: For versions prior to 5.2.0, update to version 5.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt to minimize the risk of exploitation.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2024-58103

GHSA-PWF9-Q62P-V7WC

Affected Products

Square Wire

References · 11

• https://osv.dev/vulnerability/CVE-2024-58103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58103 · Security Note
• https://osv.dev/vulnerability/GHSA-pwf9-q62p-v7wc · Vendor Advisory
• https://github.com/square/wire · Note
• https://github.com/square/wire/compare/5.1.0...5.2.0 · Note
• https://github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d · Note
• https://t.me/cvetracker/19215 · Telegram Post
• https://t.me/cvenotify/114943 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1901198935198437508 · Twitter Post
• https://twitter.com/CVEnew/status/1901125606701756735 · Twitter Post
• https://t.me/cvedetector/20395 · Telegram Post