CVE-2022-25891: Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages
(updated )
The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 is vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.
References
- github.com/advisories/GHSA-477v-w82m-634j
- github.com/containrrr/shoutrrr/commit/6a27056f9d7522a8b493216195cb7634bf4b5c42
- github.com/containrrr/shoutrrr/issues/240
- github.com/containrrr/shoutrrr/pull/242
- github.com/containrrr/shoutrrr/releases/tag/v0.6.0
- nvd.nist.gov/vuln/detail/CVE-2022-25891
- snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059
Code Behaviors & Features
Detect and mitigate CVE-2022-25891 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →