| { |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0", |
| "cveMetadata": { |
| "cveId": "CVE-2024-24786" |
| }, |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc" |
| }, |
| "title": "Infinite loop in JSON unmarshaling in google.golang.org/protobuf", |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set." |
| } |
| ], |
| "affected": [ |
| { |
| "vendor": "google.golang.org/protobuf", |
| "product": "google.golang.org/protobuf/encoding/protojson", |
| "collectionURL": "https://pkg.go.dev", |
| "packageName": "google.golang.org/protobuf/encoding/protojson", |
| "versions": [ |
| { |
| "version": "0", |
| "lessThan": "1.33.0", |
| "status": "affected", |
| "versionType": "semver" |
| } |
| ], |
| "programRoutines": [ |
| { |
| "name": "UnmarshalOptions.unmarshal" |
| }, |
| { |
| "name": "Unmarshal" |
| }, |
| { |
| "name": "UnmarshalOptions.Unmarshal" |
| } |
| ], |
| "defaultStatus": "unaffected" |
| }, |
| { |
| "vendor": "google.golang.org/protobuf", |
| "product": "google.golang.org/protobuf/internal/encoding/json", |
| "collectionURL": "https://pkg.go.dev", |
| "packageName": "google.golang.org/protobuf/internal/encoding/json", |
| "versions": [ |
| { |
| "version": "0", |
| "lessThan": "1.33.0", |
| "status": "affected", |
| "versionType": "semver" |
| } |
| ], |
| "programRoutines": [ |
| { |
| "name": "Decoder.Read" |
| }, |
| { |
| "name": "Decoder.Peek" |
| } |
| ], |
| "defaultStatus": "unaffected" |
| } |
| ], |
| "problemTypes": [ |
| { |
| "descriptions": [ |
| { |
| "lang": "en", |
| "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input" |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://go.dev/cl/569356" |
| }, |
| { |
| "url": "https://pkg.go.dev/vuln/GO-2024-2611" |
| }, |
| { |
| "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/" |
| }, |
| { |
| "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4" |
| }, |
| { |
| "url": "https://security.netapp.com/advisory/ntap-20240517-0002/" |
| } |
| ] |
| } |
| } |
| } |