Kurz gesagt
- CVE-2023-23626 ist eine Schwachstelle (HOCH (CVSS 7.5)) in github.com/ipfs/go-bitfield, go-bitfield (protocol).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.91%, höher als bei 60.0% aller Schwachstellen.
- Abhilfe: auf 1.1.0 oder neuer aktualisieren.
Description
Impact
When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics.
This happen when the size is a not a multiple of 8 or is negative.
There were already a note in the NewBitfield documentation:
Panics if size is not a multiple of 8.
But it incomplete and missing from FromBytes's documentation.
This has been replaced by returning an (Bitfield, error) and returning a non nil error if the size is wrong.
Patches
Workarounds
- Ensure
size%8 == 0 && size >= 0 yourself before calling NewBitfield or FromBytes
References
NVD description
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s. This happen when the `size` is a not a multiple of `8` or is negative. There were already a note in the `NewBitfield` documentation, however known users of this package are subject to this issue. Users are advised to upgrade. Users unable to upgrade should ensure that `size` is a multiple of 8 before calling `NewBitfield` or `FromBytes`.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free