GHSA-hf3r-vmrv-7w29

    Dashboard / Vulnerabilities / GHSA-hf3r-vmrv-7w29

    GHSA-hf3r-vmrv-7w29

    Published: 3 Jan 2024Last Modified: 4 Dec 2024

    Summary: Duplicate Advisory: Denial of service in CBOR library

    Details: ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6r92-cgxc-r5fg. This link is maintained to preserve external references. ### Original Description PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

    References: https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg, https://nvd.nist.gov/vuln/detail/CVE-2024-21909, https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95, https://github.com/advisories/GHSA-6r92-cgxc-r5fg, https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1, https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg

    Affected packages

    Package

    Name: PeterO.Cbor

    Purl: pkg:nuget/PeterO.Cbor

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 4.0.0
    Fixed -4.5.1

    Affected versions

    4.0.0
    4.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-hf3r-vmrv-7w29 | CVE-DB