6.8

CVE-2020-5234

Untrusted data can lead to DoS attack in MessagePack for C# and Unity

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Messagepack ≫ Messagepack SwPlatform c# Version < 1.9.3
Messagepack ≫ Messagepack SwPlatform c# Version >= 2.0.323 < 2.1.80
Messagepack ≫ Messagepack Version 2.0.94 Update alpha SwPlatform c#
Messagepack ≫ Messagepack Version 2.0.110 Update alpha SwPlatform c#
Messagepack ≫ Messagepack Version 2.0.119 Update beta SwPlatform c#
Messagepack ≫ Messagepack Version 2.0.123 Update beta SwPlatform c#
Messagepack ≫ Messagepack Version 2.0.204 Update beta SwPlatform c#
Messagepack ≫ Messagepack Version 2.0.270 Update rc SwPlatform c#
Messagepack ≫ Messagepack Version 2.0.299 Update rc SwPlatform c#
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.58% 0.723
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NIST 6.8 8 6.9
AV:N/AC:L/Au:S/C:N/I:N/A:C
security-advisories@github.com 4.8 1.2 3.6
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
CWE-121 Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02
Patch
Third Party Advisory
https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007
https://github.com/neuecc/MessagePack-CSharp/issues/810
https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
Third Party Advisory