blob: 6ab365cf6c9f8ff01a9bd1e36bad509bee90ceef [file] [log] [blame]
id: GO-2021-0076
modules:
- module: github.com/evanphx/json-patch
versions:
- fixed: 0.5.2
- introduced: 3.0.0+incompatible
fixed: 3.0.1-0.20180525145409-4c9aadca8f89+incompatible
vulnerable_at: 3.0.1-0.20180510154552-9f095e073247+incompatible
packages:
- package: github.com/evanphx/json-patch
symbols:
- partialArray.add
derived_symbols:
- Patch.Apply
- Patch.ApplyIndent
summary: Out-of-bounds write in github.com/evanphx/json-patch
description: |-
A malicious JSON patch can cause a panic due to an out-of-bounds write attempt.
This can be used as a denial of service vector if exposed to arbitrary user
input.
published: 2021-04-14T20:04:52Z
cves:
- CVE-2018-14632
ghsas:
- GHSA-gxhv-3hwf-wjp9
references:
- fix: https://github.com/evanphx/json-patch/pull/57
- fix: https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03
review_status: REVIEWED