Vulnerability in glog: UNKNOWN READ in google::ParseTemplateArg
Summary
OSV-2023-978: UNKNOWN READ in google::ParseTemplateArg. Affects glog versions >= a13d03babc574015e417a920968ec966a8fb68f5, < 7ba2f7bc02cdbab9314f3804c698ec78e20c441e. Fixed in 7ba2f7bc02cdbab9314f3804c698ec78e20c441e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
glog is an open-source logging library developed by Google. It provides a C++ implementation of logging functions and utilities. The library is widely used in various software projects to facilitate logging and debugging. However, a vulnerability has been discovered in glog that could potentially lead to an UNKNOWN READ exploit.
Vulnerability Detail
The vulnerability in glog resides in the google::ParseTemplateArg function. It has been reported through an OSS-Fuzz report, which can be found at OSS-Fuzz Report. The crash type associated with this vulnerability is UNKNOWN READ. The crash state involves the functions google::ParseTemplateArg, google::ParseTemplateArg, and google::ParseEncoding. Further technical details can be found in the source. This vulnerability has a medium severity rating.
How To Fix
Minimum fixed version
7ba2f7bc02cdbab9314f3804c698ec78e20c441e
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is advised to apply the fix mentioned above as soon as possible.
Conclusion
In conclusion, a vulnerability has been discovered in the glog package that could potentially lead to an UNKNOWN READ exploit. It is crucial to update the glog package to a version that includes the fix to mitigate the risk of unauthorized access or information disclosure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for glog →
FAQ
glog is an open-source logging library developed by Google. It provides a C++ implementation of logging functions and utilities.
This vulnerability could potentially be exploited to perform an UNKNOWN READ operation, which may lead to unauthorized access or information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your manifest file, such as package-lock.json, to monitor and alert in real-time for open-source vulnerabilities.
Yes, a fix for this vulnerability is available. It is recommended to update the glog package to a version that includes the fix.
You can find more information about this vulnerability in the https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63034 and the https://github.com/google/oss-fuzz-vulns/blob/main/vulns/glog/OSV-2023-978.yaml.
