CVE-2024-24786: Infinite loop in JSON unmarshaling in google.golang.org/protobuf
Last updated 18 September 2024
Other sources
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-google-protobufto a version that resolves this vulnerability.Fixed in 1.33.0-1 - Upgrade
Upgrade
go/google.golang.org/protobuf/internal/encoding/jsonto a version that resolves this vulnerability.Fixed in 1.33.0 - Upgrade
Upgrade
go/google.golang.org/protobuf/encoding/protojsonto a version that resolves this vulnerability.Fixed in 1.33.0 - Upgrade
Upgrade
go/google.golang.org/protobufto a version that resolves this vulnerability.Fixed in 1.33.0 - Upgrade
Upgrade
F5 F5OSto a version that resolves this vulnerability.Fixed in 1.5.3 - Upgrade
Upgrade
redhat/google.golang.org/protobufto a version that resolves this vulnerability.Fixed in 1.33.0 - Configuration
Do not enable UnmarshalOptions.DiscardUnknown when calling protojson.Unmarshal until you have upgraded to a fixed version.
google.golang.org/protobuf (protojson.Unmarshal) UnmarshalOptions.DiscardUnknown = disabled / do not set - Configuration
Avoid unmarshaling JSON into messages that contain a google.protobuf.Any value until you have upgraded to a fixed version.
protojson.Unmarshal (messages containing google.protobuf.Any) avoid_unmarshaling_into_google.protobuf.Any = avoid until fixed - Compensating control
Validate and sanitize JSON inputs and restrict or pre-validate untrusted JSON before passing to protojson.Unmarshal; consider rejecting malformed or unexpected JSON as a temporary mitigation.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24786?
CVE-2024-24786 is categorized as a denial of service vulnerability due to an infinite loop flaw in the rotojson.Unmarshal function.
How do I fix CVE-2024-24786?
To fix CVE-2024-24786, update the affected software packages to version 1.33.0 or later.
What software is affected by CVE-2024-24786?
CVE-2024-24786 affects the golang-google-protobuf package and certain versions of F5 and IBM products.
Can CVE-2024-24786 be exploited remotely?
Yes, CVE-2024-24786 can be exploited remotely by sending specially crafted requests that trigger the infinite loop.
What impact does CVE-2024-24786 have on systems?
The impact of CVE-2024-24786 is that it can cause a denial of service, potentially rendering the affected service unresponsive.