Unbounded Memory Usage in S3 Storage Write in maddy
Summary
GHSA-m6m5-pp4g-fcc8: S3 storage write is not aborted on errors leading to unbounded memory usage. Affects github.com/foxcpp/maddy versions < 0.5.1. Fixed in 0.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
maddy is a Go-based email server that provides a flexible and extensible platform for handling email communication. It offers various storage options, including S3 storage for message storage. The S3 storage functionality was introduced in version 0.5.0 of maddy. However, a vulnerability has been discovered in the S3 storage write process, which can lead to unbounded memory usage.
Vulnerability Detail
The vulnerability affects users who utilize the S3 storage feature in combination with the storage.imapsql configuration. When writing to S3 storage, maddy does not properly handle errors, resulting in unbounded memory usage. This can potentially lead to resource exhaustion and system instability. The issue has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0.5.1
This is the first release that contains the fix.
go get github.com/foxcpp/maddy@v0.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. Users are encouraged to apply the fix mentioned in the 'how_to_fix' section as soon as it is released.
Conclusion
The unbounded memory usage vulnerability in maddy's S3 storage write process can have severe consequences for affected users. It is crucial to update to maddy version 0.5.1 or later once it is released to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/foxcpp/maddy →
FAQ
The vulnerability affects maddy versions starting from 0.5.0 up to, but not including, 0.5.1.
The vulnerability can result in unbounded memory usage, potentially leading to resource exhaustion and system instability.
No specific workarounds have been provided. It is recommended to update to maddy version 0.5.1 or later once it is released.
Yes, the vulnerability has been addressed in a commit pushed to the master branch and will be included in the 0.5.1 release.
You can find the original report and the fix details in the references section of the vulnerability advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/foxcpp/maddy.
