CVE-2021-3121: Panic due to improper input validation in github.com/gogo/protobuf
Summary
CVE-2021-3121: Panic due to improper input validation in github.com/gogo/protobuf. Affects github.com/gogo/protobuf versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- protobuf · Bitnami
- consul · Bitnami
- protobuf-c · Alpine:v3.14
The same CVE-2021-3121 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/gogo/protobuf is a Go implementation of the Protocol Buffers data serialization format. It provides tools for generating Go code from .proto files and supports various features such as custom options, extensions, and more. This package is widely used in Go projects for efficient and reliable data serialization. However, a vulnerability has been discovered in the package that can lead to a panic due to improper input validation.
Vulnerability Detail
The vulnerability (CVE-2021-3121) arises from improper bounds checking in the generated Unmarshal methods of github.com/gogo/protobuf. Maliciously crafted input can trigger an out-of-bounds panic. This vulnerability can be exploited by attackers to launch a denial of service attack, particularly when parsing messages from untrusted sources. The impact of this vulnerability can result in the disruption of service availability and potential system crashes.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
go get github.com/gogo/protobuf@v1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
In conclusion, the vulnerability (CVE-2021-3121) in github.com/gogo/protobuf can lead to out-of-bounds panics when parsing malicious input. This can be used as a denial of service vector, impacting service availability and potentially causing system crashes. It is highly recommended to update to version 1.3.2 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/gogo/protobuf →
FAQ
github.com/gogo/protobuf is a Go package that provides an implementation of the Protocol Buffers data serialization format. It offers tools for generating Go code from .proto files and supports various features for efficient data serialization.
The vulnerability can be exploited by attackers to cause a denial of service by triggering out-of-bounds panics. This can lead to service disruptions and potential system crashes.
To fix this vulnerability, update the package to version 1.3.2 or later. Rebuild your application with the patched version of github.com/gogo/protobuf.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package.
Yes, this vulnerability can be exploited remotely by sending maliciously crafted input to the affected Unmarshal methods.
