| id: GO-2023-1631 |
| modules: |
| - module: google.golang.org/protobuf |
| versions: |
| - introduced: 1.29.0 |
| - fixed: 1.29.1 |
| vulnerable_at: 1.29.0 |
| packages: |
| - package: google.golang.org/protobuf/encoding/prototext |
| symbols: |
| - UnmarshalOptions.unmarshal |
| derived_symbols: |
| - Unmarshal |
| - UnmarshalOptions.Unmarshal |
| - package: google.golang.org/protobuf/internal/encoding/text |
| symbols: |
| - parseNumber |
| derived_symbols: |
| - Decoder.Peek |
| - Decoder.Read |
| summary: Panic when parsing invalid messages in google.golang.org/protobuf |
| description: |- |
| Parsing invalid messages can panic. |
| |
| Parsing a text-format message which contains a potential number consisting of a |
| minus sign, one or more characters of whitespace, and no further input will |
| cause a panic. |
| ghsas: |
| - GHSA-hw7c-3rfg-p46j |
| references: |
| - fix: https://go.dev/cl/475995 |
| - report: https://github.com/golang/protobuf/issues/1530 |
| cve_metadata: |
| id: CVE-2023-24535 |
| cwe: 'CWE-125: Out-of-bounds Read' |
| review_status: REVIEWED |
