CVE-2020-29242: Out-of-Bounds Read Vulnerability in github.com/dhowden/tag
Summary
CVE-2020-29242: dhowden tag panic due to out-of-bounds read. Affects github.com/dhowden/tag versions < 0.0.0-20201120070457-d52dcb253c63. Fixed in 0.0.0-20201120070457-d52dcb253c63. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/dhowden/tag is a Go library used for parsing metadata from media files. It provides various methods for reading different types of tags from files. This vulnerability affects versions prior to 0.0.0-20201120070457-d52dcb253c63. The package is susceptible to a panic due to out-of-bounds reads caused by improper bounds checking. If an attacker can supply malicious input to the package, they can trigger a denial of service attack.
Vulnerability Detail
The vulnerability in github.com/dhowden/tag arises from inadequate bounds checking in several methods. This allows for out-of-bounds reads, which can lead to a panic. If an application uses this package to parse user-supplied input, an attacker could exploit this vulnerability to cause a denial of service attack. The impact of this vulnerability is limited to the availability of the affected application.
How To Fix
Minimum fixed version
0.0.0-20201120070457-d52dcb253c63
This is the first release that contains the fix.
go get github.com/dhowden/tag@v0.0.0-20201120070457-d52dcb253c63Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the package as soon as possible.
Conclusion
The vulnerability in github.com/dhowden/tag can lead to a denial of service attack if an attacker can supply malicious input to the package. It is recommended to update to the fixed version of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/dhowden/tag →
FAQ
The vulnerability can be exploited to trigger a panic and cause a denial of service attack. However, the impact is limited to the availability of the affected application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground and it will alert you if the vulnerability is present.
The only known mitigation is to update to the fixed version of the package. There are no workarounds available.
No, this vulnerability requires the attacker to be able to supply malicious input to the package. It cannot be exploited remotely.
There is no evidence of this vulnerability being actively exploited at this time.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/dhowden/tag.
