CVE-2020-5234: Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack
(updated )
When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by either of two vectors:
- hash collisions - leading to large CPU consumption disproportionate to the size of the data being deserialized.
- stack overflow - leading to the deserializing process crashing.
References
- github.com/MessagePack-CSharp/MessagePack-CSharp
- github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
- github.com/advisories/GHSA-7q36-4xx7-xcxf
- github.com/aspnet/Announcements/issues/405
- github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02
- github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007
- github.com/neuecc/MessagePack-CSharp/issues/810
- github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
- nvd.nist.gov/vuln/detail/CVE-2020-5234
Code Behaviors & Features
Detect and mitigate CVE-2020-5234 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →