S3 storage write is not aborted on errors leading to unbounded memory usage

HOCH 7.5GHSA-m6m5-pp4g-fcc8 · GO-2022-0374 · Published 06/10/2021 · updated 21/08/2024

Kurz gesagt

GHSA-m6m5-pp4g-fcc8 ist eine Schwachstelle (HOCH (CVSS 7.5)) in github.com/foxcpp/maddy.
Abhilfe: auf 0.5.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/foxcpp/maddy Go	`< 0.5.1`	`0.5.1`

Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.

storage.imapsql local_mailboxes {
  ...
  msg_store s3 {
    ...
  }
}

The relevant commit is pushed to master and will be included in the 0.5.1 release.

No special handling of the issue has been done due to the small amount of affected users.

None.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 0.5.1

0.5.1

Description

Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.

storage.imapsql local_mailboxes {
  ...
  msg_store s3 {
    ...
  }
}

The relevant commit is pushed to master and will be included in the 0.5.1 release.

No special handling of the issue has been done due to the small amount of affected users.

None.

Weitere Schwachstellen in github.com/foxcpp/maddy

Alle anzeigen →