CVE-2020-36568: Resource exhaustion in github.com/revel/revel
Summary
CVE-2020-36568: Resource exhaustion in github.com/revel/revel. Affects github.com/revel/revel versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Also tracked for
- golang-github-revel-revel · Debian:11
The same CVE-2020-36568 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/revel/revel package is a Go web application framework that provides a high-level API for building web applications. It offers features such as routing, controller actions, and request handling. The package is widely used in the Go ecosystem for developing web applications.
Vulnerability Detail
This vulnerability allows an attacker to cause a denial-of-service (DoS) condition in applications that use the github.com/revel/revel package. By manipulating the request query sent to the application, an attacker can exploit the way the package handles slice parameters. This can lead to the allocation of large amounts of memory, causing the application to crash. The impact of this vulnerability can range from temporary unavailability of the application to a complete system failure.
How To Fix
Minimum fixed version
1.0.0
This is the first release that contains the fix.
go get github.com/revel/revel@v1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is recommended to update to the fixed version of the package as soon as possible.
Conclusion
The github.com/revel/revel package is vulnerable to a resource exhaustion issue that can lead to a denial-of-service condition in applications. Developers should update their applications to use version 1.0.0 or later of the package to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/revel/revel →
FAQ
This vulnerability can lead to a denial-of-service condition in applications that use the github.com/revel/revel package. It can cause the application to crash or become temporarily unavailable.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, only versions prior to 1.0.0 are affected. Developers should update to version 1.0.0 or later to fix the vulnerability.
No, there is currently no known workaround. It is recommended to update to the fixed version of the package.
Yes, this vulnerability can be exploited remotely by sending a manipulated request query to the application.
