Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/hamba/avro

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5GoPublished

    avro vulnerable to denial of service via attacker-controlled parameter

    CVE-2023-37475 · GHSA-9x44-9pgq-cf45

    Affected
    • Go github.com/hamba/avro < 2.13.0
    Fixed in
    2.13.0· Vendor fix available
    Issue
    A well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal() can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the consumer of avro. Details The root cause of the issue is that avro uses part of the input to Unmarshal() to determine the size when creating a new slice. In the reproducer below, the first few bytes determine the size of the slice. The root cause is on line 239 here: https://github.com/hamba/avro/blob/3abfe1e6382c5dccf2e1a00260c51a64bc1f1ca1/reader.go#L216-L242 PoC The issue was found during a security audit of Dapr, and I attach a reproducer that shows how the issue affects Dapr. Dapr uses an older version of the avro library, but it is also affected if bumping avro to latest. To reproduce: now add this test to the pulsartest.go: run the test with go test -run=TestParsePublishMetadata2. You should see this stacktrace: Impact Any use case of the avro Unmarshalling routine that accepts…

    Recommended action: Upgrade to 2.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →