| id: GO-2021-0076 |
| modules: |
| - module: github.com/evanphx/json-patch |
| versions: |
| - fixed: 0.5.2 |
| - introduced: 3.0.0+incompatible |
| - fixed: 3.0.1-0.20180525145409-4c9aadca8f89+incompatible |
| vulnerable_at: 3.0.1-0.20180510154552-9f095e073247+incompatible |
| packages: |
| - package: github.com/evanphx/json-patch |
| symbols: |
| - partialArray.add |
| derived_symbols: |
| - Patch.Apply |
| - Patch.ApplyIndent |
| summary: Out-of-bounds write in github.com/evanphx/json-patch |
| description: |- |
| A malicious JSON patch can cause a panic due to an out-of-bounds write attempt. |
| This can be used as a denial of service vector if exposed to arbitrary user |
| input. |
| published: 2021-04-14T20:04:52Z |
| cves: |
| - CVE-2018-14632 |
| ghsas: |
| - GHSA-gxhv-3hwf-wjp9 |
| references: |
| - fix: https://github.com/evanphx/json-patch/pull/57 |
| - fix: https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03 |
| review_status: REVIEWED |
