Medium, CVSS 4.8NuGetPublished
Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack
CVE-2020-5234 · GHSA-7q36-4xx7-xcxf
- Affected
- NuGet messagepack.unity < 1.9.11; >= 2.0.0, < 2.1.90
- Fixed in
- 1.9.112.1.90· Vendor fix available
- Issue
- Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by either of two vectors: 1. hash collisions - leading to large CPU consumption disproportionate to the size of the data being deserialized. 1. stack overflow - leading to the deserializing process crashing. Patches The following steps are required to mitigate this risk. 1. Upgrade to a version of the library where a fix is available 1. Add code to your application to put MessagePack into the defensive UntrustedData mode. 1. Identify all MessagePack extensions that implement IMessagePackFormatter<T implementations that do not ship with the MessagePack library to include the security mitigations. This includes those acquired from 3rd party packages and classes included directly into your project. Any AOT formatters generated with the MPC tool must be regenerated with the patched version of mpc. 1. Review your messagepack-serializable data structures…
Recommended action: Upgrade to 2.1.90 or 1.9.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.