Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
References
| Link | Resource |
|---|---|
| https://github.com/golang/protobuf/issues/1530 | Issue Tracking |
| https://go.dev/cl/475995 | Patch |
| https://pkg.go.dev/vuln/GO-2023-1631 | Third Party Advisory |
| https://github.com/golang/protobuf/issues/1530 | Issue Tracking |
| https://go.dev/cl/475995 | Patch |
| https://pkg.go.dev/vuln/GO-2023-1631 | Third Party Advisory |
Configurations
History
21 Nov 2024, 07:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/golang/protobuf/issues/1530 - Issue Tracking | |
| References | () https://go.dev/cl/475995 - Patch | |
| References | () https://pkg.go.dev/vuln/GO-2023-1631 - Third Party Advisory |
15 Jun 2023, 19:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/golang/protobuf/issues/1530 - Issue Tracking | |
| References | (MISC) https://go.dev/cl/475995 - Patch | |
| References | (MISC) https://pkg.go.dev/vuln/GO-2023-1631 - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-125 | |
| CPE | cpe:2.3:a:protobuf:protobuf:1.29.0:*:*:*:*:go:*:* |
08 Jun 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-08 21:15
Updated : 2025-01-06 20:15
NVD link : CVE-2023-24535
Mitre link : CVE-2023-24535
CVE.ORG link : CVE-2023-24535
JSON object : View
Products Affected
protobuf
- protobuf
CWE
CWE-125
Out-of-bounds Read