Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS02cjkyLWNneGMtcjVmZ80kJw

Denial of service in CBOR library

Impact

Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to DecodeFromBytes or other CBOR decoding mechanisms in this library.

Affected versions include versions 4.0.0 through 4.5.0.

This vulnerability was privately reported to me.

Patches

This issue has been fixed in version 4.5.1. Users should use the latest version of this library. (The latest version is not necessarily 4.5.1. Check the NuGet page to see the latest version's version number.)

Workarounds

Again, users should use the latest version of this library.

In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps. An input that decodes to a single CBOR object is not capable of containing a CBOR map if—

it begins with a byte other than 0x80 through 0xDF, or
it does not contain a byte in the range 0xa0 through 0xBF.

Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.

For more information

If you have any questions or comments about this advisory:

Open an issue in the CBOR repository.

Permalink: https://github.com/advisories/GHSA-6r92-cgxc-r5fg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cjkyLWNneGMtcjVmZ80kJw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: about 1 year ago

EPSS Percentage: 0.00229
EPSS Percentile: 0.60806

Identifiers: GHSA-6r92-cgxc-r5fg, CVE-2024-21909
References:

Repository: https://github.com/peteroupc/CBOR
Blast Radius: 1.0

Affected Packages

nuget:PeterO.Cbor

Dependent packages: 21
Dependent repositories: 0
Downloads: 5,474,590 total
Affected Version Ranges: >= 4.0.0, < 4.5.1
Fixed in: 4.5.1
All affected versions: 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.2.0, 4.3.0, 4.4.0, 4.4.1, 4.4.2, 4.4.4, 4.5.0
All unaffected versions: 0.21.0, 0.22.0, 0.23.0, 1.0.0, 1.1.0, 1.2.0, 1.3.0, 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1.0, 3.2.0, 3.2.1, 3.3.0, 3.4.0, 3.5.0, 3.5.1, 3.5.2, 3.6.0, 4.5.1, 4.5.2, 4.5.3, 4.5.5