Vulnerability · Published Jan 31, 2020 · Assigned by GitHub_M
CVE-2020-5234Untrusted data can lead to DoS attack in MessagePack for C# and Unity
Medium 4.8
In plain English
A medium-severity stack buffer overflow in MessagePack from neuecc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)1.6%top 24.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | messagepack | 2.1.90 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack | 1.9.11 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack.immutablecollection | 1.9.11 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack.immutablecollection | 2.1.90 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack.reactiveproperty | 2.1.90 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack.reactiveproperty | 1.9.11 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack.unity | 1.9.11 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack.unity | 2.1.90 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack.unityshims | 1.9.11 | GHSA-7q36-4xx7-xcxf |
| NuGet | messagepack.unityshims | 2.1.90 | GHSA-7q36-4xx7-xcxf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| neuecc | MessagePack | < 1.9.11>= 2.0.0, < 2.1.90 |
| neuecc | MessagePack.ImmutableCollection | < 1.9.11>= 2.0.0, < 2.1.90 |
| neuecc | MessagePack.ReactiveProperty | < 1.9.11>= 2.0.0, < 2.1.90 |
| neuecc | MessagePack.UnityShims | < 1.9.11>= 2.0.0, < 2.1.90 |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
References
- https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf x_refsource_CONFIRM
- https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02 x_refsource_MISC
- https://github.com/neuecc/MessagePack-CSharp/issues/810 x_refsource_MISC
- https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007 x_refsource_MISC