Severity
6.9
Medium severity
Details
- CVSS score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.Details
- Affected product:
- Grafana , IBM/go-sdk-core , IBM/ibm-cos-sdk-go , Loki , MinIO , argocd , cortexproject/cortex , go-openapi/analysis , go-openapi/loads , go-openapi/runtime , go-openapi/strfmt , go-openapi/validate , golang-migrate/migrate , google/go-cloud , grafana/alerting , grafana/e2e , grafana/grafana-openapi-client-go , grafana/grafana/pkg/promlib , grafana/grafana/pkg/storage/unified/apistore , grafana/grafana/pkg/storage/unified/resource , grafana/tempo , hashicorp/consul , hashicorp/hcp-scada-provider , hashicorp/hcp-sdk-go , influxdata/telegraf , jaegertracing/jaeger , m3dbx/prometheus_remote_client_golang , mongodb/mongo-go-driver , open-telemetry/opentelemetry-collector , ory/fosite , ory/x , prometheus/alertmanager , prometheus/prom2json , prometheus/prometheus , thanos-io/thanos
- Affected packages:
- github.com/go-openapi/strfmt @ 0.22.0 (+98 more)