CVE-2020-26213: Denial-of-Service within Docker container in ktbs.dev/teler/pkg/errors
Summary
CVE-2020-26213: Denial-of-Service within Docker container. Affects ktbs.dev/teler versions < 0.0.1. Fixed in 0.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ktbs.dev/teler/pkg/errors package is a part of the Go ecosystem and is used in the teler application. It provides error handling functionality for the application. However, a vulnerability has been discovered in versions prior to 0.0.1 that can lead to a denial-of-service (DoS) attack when running teler inside a Docker container.
Vulnerability Detail
The vulnerability arises from the improper handling of the errors.Exit function in the teler application. When encountering this function, the process ID and process group ID of teler are not obtained correctly, resulting in a DoS condition where the application crashes with a SIGSEGV signal. This vulnerability can be exploited by an attacker to disrupt the availability of the teler application running in a Docker container.
How To Fix
Minimum fixed version
0.0.1
This is the first release that contains the fix.
go get ktbs.dev/teler@v0.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability.
Conclusion
The ktbs.dev/teler/pkg/errors package in versions prior to 0.0.1 is vulnerable to a denial-of-service (DoS) attack when running teler inside a Docker container. Upgrading to version 0.0.1 or later is recommended to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ktbs.dev/teler →
FAQ
The vulnerability can lead to a denial-of-service (DoS) condition in the teler application running inside a Docker container.
The risk can be mitigated by upgrading to version 0.0.1 or later of the ktbs.dev/teler/pkg/errors package.
There is no known exploit available for this vulnerability at the moment.
There are no alternative packages mentioned in the vulnerability details.
For more information, you can refer to the GitHub advisory at https://github.com/kitabisa/teler/commit/ec6082049dba9e44a21f35fb7b123d42ce1a1a7e
