Lucene search
Ubuntu.comUB:CVE-2023-24535HistoryJun 08, 2023 - 12:00 a.m.
CVE-2023-24535
2023-06-0800:00:00
ubuntu.com
ubuntu.com
13
parsing vulnerability
invalid messages
panic
text-format
number
whitespace
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
34.1%
Parsing invalid messages can panic. Parsing a text-format message which
contains a potential number consisting of a minus sign, one or more
characters of whitespace, and no further input will cause a panic.
Notes
| Author | Note |
|---|---|
| alexmurray | google-guest-agent contains a vendored copy of golang-goprotobuf |
| mdeslaur | Introduced by: https://go-review.googlesource.com/c/protobuf/+/473015 Fixed by: https://github.com/protocolbuffers/protobuf-go/commit/edaf511a7a37a90db2727b600d699e1e8d2840b4 |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 24.04 | noarch | golang-github-golang-protobuf-1-3 | < any | UNKNOWN |
| ubuntu | 24.04 | noarch | golang-github-golang-protobuf-1-5 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | golang-goprotobuf | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | golang-goprotobuf | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | golang-goprotobuf | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | golang-goprotobuf | < any | UNKNOWN |
Related
redhatcve
redhatcve
CVE-2023-24535
2023-06-14 09:15:29
cgr
cgr
CVE-2023-24535 vulnerabilities
2024-05-19 03:07:16
osv
osv
Panic when parsing invalid messages in google.golang.org/protobuf
2023-03-14 16:47:00
google.golang.org/protobuf vulnerable to panic leading to denial of service
2023-03-14 23:01:50
CVE-2023-24535
2023-06-08 21:15:16
veracode
veracode
Denial Of Service (DoS)
2023-03-16 02:17:33
debiancve
debiancve
CVE-2023-24535
2023-06-08 21:15:16
nessus
nessus
Google Protobuf Go Module 1.29 < 1.29.1 DoS
2023-04-12 00:00:00
ibm
ibm
cve
cve
CVE-2023-24535
2023-06-08 21:15:16
nvd
nvd
CVE-2023-24535
2023-06-08 21:15:16
prion
prion
Input validation
2023-06-08 21:15:00
cvelist
cvelist
github
github
google.golang.org/protobuf vulnerable to panic leading to denial of service
2023-03-14 23:01:50
wolfi
wolfi
CVE-2023-24535 vulnerabilities
2024-10-01 21:13:23
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
34.1%
Related for UB:CVE-2023-24535