Overview
About vulnerability
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 7 ELS , FZambia/eagle , Grafana , Loki , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , apache/arrow , apache/arrow/go , apache/arrow/go/arrow , bufbuild/connect-go , bufbuild/protoc-gen-validate , bufbuild/protocompile , census-ecosystem/opencensus-go-exporter-prometheus/prometheus , census-ecosystem/opencensus-go-exporter-stackdriver/stackdriver , census-instrumentation/opencensus-proto , centrifugal/centrifuge , centrifugal/protocol , cockroachdb/errors , contrib.go.opencensus.io/exporter/prometheus , digitalocean/godo , envoyproxy/go-control-plane , etcd-io/etcd/api , etcd-io/etcd/client , fullstorydev/grpchan , github.com/apache/arrow/go/arrow , github.com/centrifugal/centrifuge , github.com/golang/protobuf , github.com/grafana/grafana-plugin-sdk-go , github.com/prometheus/client_golang , github.com/prometheus/statsd_exporter , go-kit/kit , go.opentelemetry.io/collector , golang-migrate/migrate , golang/appengine , golang/protobuf , google.golang.org/grpc/cmd/protoc-gen-go-grpc , google.golang.org/protobuf , google/cel-go , google/gnostic-models , google/go-cloud , google/go-replayers/grpcreplay , google/go-replayers/httpreplay , google/martian , google/s2a-go , google/starlark-go , googleapis/gax-go , googleapis/go-genproto , googleapis/go-genproto/googleapis/api , googleapis/go-genproto/googleapis/bytestream , googleapis/go-genproto/googleapis/rpc , googleapis/google-api-go-client , googleapis/google-cloud-go , googleapis/google-cloud-go-testing , googleapis/google-cloud-go/accessapproval , googleapis/google-cloud-go/accesscontextmanager , googleapis/google-cloud-go/aiplatform , googleapis/google-cloud-go/analytics , googleapis/google-cloud-go/apigateway , googleapis/google-cloud-go/apigeeconnect , googleapis/google-cloud-go/apigeeregistry , googleapis/google-cloud-go/appengine , googleapis/google-cloud-go/area120 , googleapis/google-cloud-go/artifactregistry , googleapis/google-cloud-go/asset , googleapis/google-cloud-go/assuredworkloads , googleapis/google-cloud-go/automl , googleapis/google-cloud-go/baremetalsolution , googleapis/google-cloud-go/batch , googleapis/google-cloud-go/beyondcorp , googleapis/google-cloud-go/bigquery , googleapis/google-cloud-go/billing , googleapis/google-cloud-go/binaryauthorization , googleapis/google-cloud-go/certificatemanager , googleapis/google-cloud-go/channel , googleapis/google-cloud-go/cloudbuild , googleapis/google-cloud-go/clouddms , googleapis/google-cloud-go/cloudtasks , googleapis/google-cloud-go/compute , googleapis/google-cloud-go/contactcenterinsights , googleapis/google-cloud-go/container , googleapis/google-cloud-go/containeranalysis , googleapis/google-cloud-go/datacatalog , googleapis/google-cloud-go/dataflow , googleapis/google-cloud-go/dataform , googleapis/google-cloud-go/datafusion , googleapis/google-cloud-go/datalabeling , googleapis/google-cloud-go/dataplex , googleapis/google-cloud-go/dataproc , googleapis/google-cloud-go/dataqna , googleapis/google-cloud-go/datastore , googleapis/google-cloud-go/datastream , googleapis/google-cloud-go/deploy , googleapis/google-cloud-go/dialogflow , googleapis/google-cloud-go/dlp , googleapis/google-cloud-go/documentai , googleapis/google-cloud-go/domains , googleapis/google-cloud-go/edgecontainer , googleapis/google-cloud-go/errorreporting , googleapis/google-cloud-go/essentialcontacts , googleapis/google-cloud-go/eventarc , googleapis/google-cloud-go/filestore , googleapis/google-cloud-go/firestore , googleapis/google-cloud-go/functions , googleapis/google-cloud-go/gkebackup , googleapis/google-cloud-go/gkeconnect , googleapis/google-cloud-go/gkehub , googleapis/google-cloud-go/gkemulticloud , googleapis/google-cloud-go/grafeas , googleapis/google-cloud-go/gsuiteaddons , googleapis/google-cloud-go/iam , googleapis/google-cloud-go/iap , googleapis/google-cloud-go/ids , googleapis/google-cloud-go/iot , googleapis/google-cloud-go/kms , googleapis/google-cloud-go/language , googleapis/google-cloud-go/lifesciences , googleapis/google-cloud-go/logging , googleapis/google-cloud-go/longrunning , googleapis/google-cloud-go/managedidentities , googleapis/google-cloud-go/maps , googleapis/google-cloud-go/mediatranslation , googleapis/google-cloud-go/memcache , googleapis/google-cloud-go/metastore , googleapis/google-cloud-go/monitoring , googleapis/google-cloud-go/networkconnectivity , googleapis/google-cloud-go/networkmanagement , googleapis/google-cloud-go/networksecurity , googleapis/google-cloud-go/notebooks , googleapis/google-cloud-go/optimization , googleapis/google-cloud-go/orchestration , googleapis/google-cloud-go/orgpolicy , googleapis/google-cloud-go/osconfig , googleapis/google-cloud-go/oslogin , googleapis/google-cloud-go/phishingprotection , googleapis/google-cloud-go/policytroubleshooter , googleapis/google-cloud-go/privatecatalog , googleapis/google-cloud-go/pubsub , googleapis/google-cloud-go/pubsublite , googleapis/google-cloud-go/recaptchaenterprise , googleapis/google-cloud-go/recommendationengine , googleapis/google-cloud-go/recommender , googleapis/google-cloud-go/redis , googleapis/google-cloud-go/resourcemanager , googleapis/google-cloud-go/resourcesettings , googleapis/google-cloud-go/retail , googleapis/google-cloud-go/run , googleapis/google-cloud-go/scheduler , googleapis/google-cloud-go/secretmanager , googleapis/google-cloud-go/security , googleapis/google-cloud-go/securitycenter , googleapis/google-cloud-go/servicedirectory , googleapis/google-cloud-go/shell , googleapis/google-cloud-go/spanner , googleapis/google-cloud-go/speech , googleapis/google-cloud-go/storage , googleapis/google-cloud-go/storagetransfer , googleapis/google-cloud-go/talent , googleapis/google-cloud-go/texttospeech , googleapis/google-cloud-go/tpu , googleapis/google-cloud-go/trace , googleapis/google-cloud-go/translate , googleapis/google-cloud-go/video , googleapis/google-cloud-go/videointelligence , googleapis/google-cloud-go/vision , googleapis/google-cloud-go/vmmigration , googleapis/google-cloud-go/vmwareengine , googleapis/google-cloud-go/vpcaccess , googleapis/google-cloud-go/webrisk , googleapis/google-cloud-go/websecurityscanner , googleapis/google-cloud-go/workflows , googlesource/oauth2 , googlesource/protobuf , grafana/alerting , grafana/dataplane/examples , grafana/dskit , grafana/grafana-aws-sdk , grafana/grafana-azure-sdk-go , grafana/grafana-plugin-sdk-go , grafana/kindsys , grafana/pyroscope/api , grafana/sqlds , grafana/tempo , grafana/thema , grpc-ecosystem/go-grpc-prometheus , grpc-ecosystem/grpc-gateway , grpc-ecosystem/grpc-gateway/protocolbuffers/go , grpc/grpc-go , grpc/grpc-go/cmd/protoc-gen-go-grpc , grpc/grpc-go/examples , harness/drone-cli , hashicorp/go-plugin , hetznercloud/hcloud-go , influxdata/influxdb-client-go , ionos-cloud/sdk-go , jhump/goprotoc , jhump/protoreflect , kubernetes-sigs/apiserver-network-proxy/konnectivity-client , kubernetes/api , kubernetes/apimachinery , kubernetes/apiserver , kubernetes/client-go , kubernetes/code-generator , kubernetes/component-base , kubernetes/kms , kubernetes/kube-aggregator , kubernetes/kube-openapi , lyft/protoc-gen-star , matttproud/golang_protobuf_extensions , oapi-codegen/oapi-codegen , onsi/ginkgo , open-telemetry/opentelemetry-collector , open-telemetry/opentelemetry-collector/pdata , open-telemetry/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc , open-telemetry/opentelemetry-go-contrib/samplers/jaegerremote , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace/otlptracegrpc , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace/otlptracehttp , open-telemetry/opentelemetry-proto-go/otlp , ory/fosite , ory/herodot , ory/x , parca-dev/parca/bufbuild/connect-go , parca-dev/parca/protocolbuffers/go , prometheus/alertmanager , prometheus/client_golang , prometheus/client_model , prometheus/common , prometheus/exporter-toolkit , prometheus/prometheus , prometheus/statsd_exporter , spf13/afero
- Affected packages:
- google.golang.org/protobuf @ 1.28.1 (+270 more)