CVE-2024-24786
Description
A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate impact because exploitation is restricted to denial of service via excessive CPU and thread consumption, without compromising data confidentiality or system integrity. Red Hat services and containerized components are only exposed if they process untrusted JSON inputs into Protocol Buffer structures configured with specific parsing behaviors. Under typical deployments, the flaw does not grant privileged access or permit arbitrary code execution.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
