Vulnerabilities in pkg:golang/github.com/mostynb/go-grpc-compression
PACKAGEGHSA-87m9-rv8p-rgmg is a HIGH (CVSS 7.5) go-grpc-compression has a zstd decompression vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Github.com/mostynb/go grpc compression libraries in the Go ecosystem. The issue involves go-grpc-compression has a zstd decompression bombing vulnerability. Remediation is available by upgrading affected packages to version 1.2.3.
pkg:golang/github.com/mostynb/go-grpc-compression
Vulnerability advisories affecting package pkg:golang/github.com/mostynb/go-grpc-compression. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-87m9-rv8p-rgmg | - | HIGH | go-grpc-compression has a zstd decompression bombing vulnerability |
GHSA-87m9-rv8p-rgmg at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix GHSA-87m9-rv8p-rgmg
To remediate this vulnerability, upgrade all affected Github.com/mostynb/go grpc compression dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/mostynb/go-grpc-compression to 1.2.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/mostynb/go-grpc-compressionHow to Check if You Are Affected
To determine whether your application is affected by GHSA-87m9-rv8p-rgmg, inspect your project dependencies for Github.com/mostynb/go grpc compression:
inspect dependencies for github.com/mostynb/go-grpc-compressionAnalyze the terminal output to locate any version of Github.com/mostynb/go grpc compression in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.3), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Github.com/mostynb/go grpc compression, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-87m9-rv8p-rgmg Affected Github.com/mostynb/go grpc compression Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/mostynb/go-grpc-compression
|
Go |
≥ 1.1.4
< 1.2.3
|
1.2.3
|
References
Frequently Asked Questions
What is GHSA-87m9-rv8p-rgmg?
Which Github.com/mostynb/go grpc compression versions are affected?
What version fixes GHSA-87m9-rv8p-rgmg?
Is github.com/mostynb/go-grpc-compression affected?
What is the CVSS score of GHSA-87m9-rv8p-rgmg?
What CWE is associated with GHSA-87m9-rv8p-rgmg?
How can I check Go dependencies for GHSA-87m9-rv8p-rgmg?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-87m9-rv8p-rgmg",
"modified" : "2024-06-17T15:27:43Z",
"published" : "2024-06-10T18:36:23Z",
"aliases" : [ ],
"summary" : "go-grpc-compression has a zstd decompression bombing vulnerability",
"details" : "### Impact\n\nA malicious user could cause a denial of service (DoS) when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases.\n\nVersions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll function in github.com/klauspost/compress/zstd to decompress data provided by the peer. The vulnerability is exploitable only by attackers who can send gRPC payloads to users of github.com/mostynb/go-grpc-compression/zstd or github.com/mostynb/go-grpc-compression/nonclobbering/zstd.\n\n### Patches\n\nVersion v1.2.3 of github.com/mostynb/go-grpc-compression avoids the issue by not using the Decoder.DecodeAll function in github.com/klauspost/compress/zstd.\n\nAll users of github.com/mostynb/go-grpc-compression/zstd or github.com/mostynb/go-grpc-compression/nonclobbering/zstd in the affected versions should update to v1.2.3.\n\n### Workarounds\n\nOther compression formats were not affected, users may consider switching from zstd to another format without upgrading to a newer release.\n\n### References\n\nThis issue was uncovered during a security audit performed by [Miroslav Stampar](https://github.com/stamparm/) of [7ASecurity](https://7asecurity.com/), facilitated by [OSTIF](https://ostif.org/), for the OpenTelemetry project.\n\nhttps://opentelemetry.io/blog/2024/cve-2024-36129\nhttps://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/mostynb/go-grpc-compression"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.1.4"
}, {
"fixed" : "1.2.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/mostynb/go-grpc-compression/security/advisories/GHSA-87m9-rv8p-rgmg"
}, {
"type" : "WEB",
"url" : "https://github.com/mostynb/go-grpc-compression/commit/629c44d3acb9624993cc7de629f47d72109e2ce5"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/mostynb/go-grpc-compression"
}, {
"type" : "WEB",
"url" : "https://pkg.go.dev/vuln/GO-2024-2911"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-400" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-06-10T18:36:23Z",
"nvd_published_at" : null
}
}