CVE-2021-3121 — Improper Validation of Array Index in Gogo Protobuf

CWE-129 — Improper Validation of Array IndexCWE-20 — Improper Input Validation7 documents5 sources
Severity
8.6HIGHNVD
EPSS
0.1%
top 66.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Github.com Gogo ProtobufGolang ProtobufHashicorp Consul+1 more
Timeline
PublishedJan 11
Latest updateMar 28

Description

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HExploitability: 3.9 | Impact: 4.7

Affected Packages4 packages

▶debiandebian/golang-gogoprotobuf< golang-gogoprotobuf 1.3.2-1 (bookworm)
▶NVDgolang/protobuf< 1.3.2
▶NVDhashicorp/consul1.9.0 — 1.9.9+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Improper Input Validation in GoGo Protobuf↗2022-03-28
▶
GHSA
Improper Input Validation in GoGo Protobuf↗2022-03-28
▶
OSV
Panic due to improper input validation in github.com/gogo/protobuf↗2021-04-14
▶
OSV
CVE-2021-3121: An issue was discovered in GoGo Protobuf before 1↗2021-01-11
▶

📋Vendor Advisories

2
Red Hat
gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation↗2021-01-11
▶
Debian
CVE-2021-3121: golang-gogoprotobuf - An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...↗2021
▶