CVE-2024-24786

Description

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

CVSS Metrics

• v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.26%• Percentile: 68%

Affected Systems

• chainguard•aactl

  < 0.4.12-r8

• chainguard•actions-runner-controller

  < 0.8.3-r2

• chainguard•actions-runner-controller-compat

  < 0.8.3-r2

• chainguard•amass

  < 4.2.0-r8

• chainguard•apisix-ingress-controller

  < 2.0.1-r2

• chainguard•argo-workflows

  < 3.5.5-r4

• chainguard•argo-workflows-fips

  < 3.5.5-r2

• chainguard•atlantis

  < 0.27.2-r1

• chainguard•atlantis-fips

  < 0.27.2-r1

• chainguard•aws-ebs-csi-driver

  < 1.28.0-r2

• chainguard•aws-efs-csi-driver

  < 1.7.6-r2

• chainguard•aws-efs-csi-driver-fips

  < 1.7.0-r5

• chainguard•aws-flb-kinesis

  < 1.10.2-r8

• chainguard•aws-flb-kinesis-compat

  < 1.10.2-r8

• chainguard•aws-flb-kinesis-compat-fips

  < 1.10.2-r1

• chainguard•aws-flb-kinesis-fips

  < 1.10.2-r1

• chainguard•aws-load-balancer-controller

  < 2.7.1-r2

• chainguard•aws-load-balancer-controller-compat

  < 2.7.1-r2

• chainguard•aws-load-balancer-controller-fips

  < 2.7.1-r2

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r6

• chainguard•azure-aad-pod-identity-nmi

  < 1.8.17-r6

• chainguard•bank-vaults

  < 1.20.4-r10

• chainguard•bank-vaults-fips

  < 1.20.4-r6

• chainguard•bank-vaults-template

  < 1.20.4-r10

• chainguard•bank-vaults-template-fips

  < 1.20.4-r6

• chainguard•boring-registry

  < 0.13.2-r3

• chainguard•boring-registry-fips

  < 0.13.2-r2

• chainguard•buf

  < 1.30.0-r0

• chainguard•buildctl

  < 0.13.0-r1

• chainguard•buildkitd

  < 0.13.0-r1

• chainguard•caddy

  < 2.7.6-r4

• chainguard•caddy-fips

  < 2.7.6-r1

• chainguard•caddy-man

  < 2.7.6-r1

• chainguard•cadvisor

  < 0.49.1-r3

• chainguard•capslock

  < 0.2.2-r0

• chainguard•cass-operator

  < 1.18.2-r5

• chainguard•cass-operator-compat

  < 1.18.2-r5

• chainguard•cass-operator-compat-fips

  < 1.18.2-r4

• chainguard•cass-operator-config

  < 1.18.2-r5

• chainguard•cass-operator-fips

  < 1.18.2-r4

• chainguard•cass-operator-fips-no-pvc-delete

  < 1.18.2-r5

• chainguard•cass-operator-fips-no-pvc-delete-compat

  < 1.18.2-r5

• chainguard•cert-exporter

  < 2.12.0-r2

• chainguard•cert-exporter-fips

  < 2.12.0-r2

• chainguard•certificate-transparency

  < 1.1.8-r0

• chainguard•certificate-transparency-fips

  < 1.1.8-r0

• chainguard•cfssl

  < 1.6.5-r1

• chainguard•cfssl-bundle

  < 1.6.5-r1

• chainguard•cfssl-certinfo

  < 1.6.5-r1

• chainguard•cfssl-json

  < 1.6.5-r1

Showing first 50 affected entries in server-rendered view.

References (32)

• https://go.dev/cl/569356
• https://pkg.go.dev/vuln/GO-2024-2611
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/
• http://www.openwall.com/lists/oss-security/2024/03/08/4
• https://security.netapp.com/advisory/ntap-20240517-0002/
• https://nvd.nist.gov/vuln/detail/CVE-2024-24786
• https://github.com/protocolbuffers/protobuf-go/commit/f01a588e5810b90996452eec4a28f22a0afae023
• https://github.com/protocolbuffers/protobuf-go
• https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.33.0
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU
• https://security.netapp.com/advisory/ntap-20240517-0002
• https://access.redhat.com/errata/RHSA-2024:1461
• https://access.redhat.com/security/updates/classification/#moderate
• https://bugzilla.redhat.com/show_bug.cgi?id=2268046
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1461.json
• https://access.redhat.com/security/cve/CVE-2024-24786
• https://www.cve.org/CVERecord?id=CVE-2024-24786
• https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/
• https://access.redhat.com/errata/RHSA-2024:1874
• https://issues.redhat.com/browse/HMS-3843
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1874.json
• https://access.redhat.com/errata/RHSA-2024:2550
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2550.json
• https://access.redhat.com/errata/RHSA-2024:3715
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3715.json
• https://access.redhat.com/errata/RHSA-2024:4246
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4246.json
• https://ubuntu.com/security/CVE-2024-24786
• https://go-review.googlesource.com/c/protobuf/+/569356
• https://ubuntu.com/security/notices/USN-6746-1
• https://ubuntu.com/security/notices/USN-6746-2
• https://security-tracker.debian.org/tracker/CVE-2024-24786