afero icon indicating copy to clipboard operation
afero copied to clipboard

fix: fixed vulnerable protobuf version 1.31.0. See CVE-2024-24786

Open manuelkasiske4idealo opened this issue 9 months ago • 2 comments

CVE-2024-24786, Score: 7.5

In the package google.golang.org/protobuf versions prior to 1.33.0, the "protojson.Unmarshal" function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a "google.protobuf.Any" value, or when the "UnmarshalOptions.DiscardUnknown" option is set.

https://devhub.checkmarx.com/cve-details/CVE-2024-24786/

manuelkasiske4idealo avatar May 21 '24 19:05 manuelkasiske4idealo