CVE-2013-10005: Infinite loop in github.com/btcsuite/go-socks
Summary
CVE-2013-10005: Infinite loop in github.com/btcsuite/go-socks. Affects github.com/btcsuite/go-socks versions < 0.0.0-20130808000456-233bccbb1abe. Fixed in 0.0.0-20130808000456-233bccbb1abe. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/btcsuite/go-socks is a Go implementation of the SOCKS protocol. It provides functionality for creating SOCKS proxy servers and clients. The package allows users to establish secure connections through SOCKS proxies. However, a vulnerability has been discovered in the package that can lead to an infinite loop and a stack overflow, causing the program to crash.
Vulnerability Detail
The vulnerability in github.com/btcsuite/go-socks is related to the RemoteAddr and LocalAddr methods on the returned net.Conn object. These methods may call themselves recursively, resulting in an infinite loop. This can lead to a stack overflow and cause the program to crash. The vulnerability can be exploited by an attacker to disrupt the functioning of the program and potentially execute arbitrary code.
How To Fix
Minimum fixed version
0.0.0-20130808000456-233bccbb1abe
This is the first release that contains the fix.
go get github.com/btcsuite/go-socks@v0.0.0-20130808000456-233bccbb1abeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to update to a fixed version of the package as soon as possible.
Conclusion
The vulnerability in github.com/btcsuite/go-socks can lead to an infinite loop and stack overflow, causing the program to crash. Users are advised to update to a fixed version of the package to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/btcsuite/go-socks →
FAQ
The vulnerability can lead to a stack overflow and program crash, potentially allowing an attacker to execute arbitrary code.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for vulnerabilities.
There are no known public exploits for this vulnerability at the moment. However, it is important to update to a fixed version to prevent potential attacks.
No, updating to a fixed version of the package is the only way to mitigate the risk associated with this vulnerability.
You can find more information about this vulnerability in the Go Vulnerability Database at https://pkg.go.dev/vuln/GO-2020-0024.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.