[
  {
    "groups": [
      {
        "experimentalAnalysis": {
          "GO-2021-0053": {
            "called": false
          }
        },
        "ids": [
          "GHSA-c3h9-896r-86jm",
          "GO-2021-0053"
        ]
      }
    ],
    "package": {
      "ecosystem": "Go",
      "name": "github.com/gogo/protobuf",
      "version": "1.3.1"
    },
    "vulnerabilities": [
      {
        "affected": [
          {
            "database_specific": {
              "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-c3h9-896r-86jm/GHSA-c3h9-896r-86jm.json"
            },
            "package": {
              "ecosystem": "Go",
              "name": "github.com/gogo/protobuf",
              "purl": "pkg:golang/github.com/gogo/protobuf"
            },
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "1.3.2"
                  }
                ],
                "type": "SEMVER"
              }
            ]
          }
        ],
        "aliases": [
          "CVE-2021-3121"
        ],
        "database_specific": {
          "cwe_ids": [
            "CWE-129",
            "CWE-20"
          ],
          "github_reviewed": true,
          "github_reviewed_at": "2022-03-28T20:28:00Z",
          "nvd_published_at": "2021-01-11T06:15:00Z",
          "severity": "HIGH"
        },
        "details": "An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the \"skippy peanut butter\" issue.",
        "id": "GHSA-c3h9-896r-86jm",
        "modified": "2022-03-28T20:28:00Z",
        "published": "2022-03-28T20:28:00Z",
        "references": [
          {
            "type": "ADVISORY",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3121"
          },
          {
            "type": "WEB",
            "url": "https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc"
          },
          {
            "type": "WEB",
            "url": "https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025"
          },
          {
            "type": "PACKAGE",
            "url": "https://github.com/gogo/protobuf"
          },
          {
            "type": "WEB",
            "url": "https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2"
          },
          {
            "type": "WEB",
            "url": "https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E"
          },
          {
            "type": "WEB",
            "url": "https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "type": "WEB",
            "url": "https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "type": "WEB",
            "url": "https://pkg.go.dev/vuln/GO-2021-0053"
          },
          {
            "type": "WEB",
            "url": "https://security.netapp.com/advisory/ntap-20210219-0006/"
          }
        ],
        "schema_version": "1.3.0",
        "summary": "Improper Input Validation in GoGo Protobuf"
      },
      {
        "affected": [
          {
            "database_specific": {
              "source": "https://vuln.go.dev/ID/GO-2021-0053.json",
              "url": "https://pkg.go.dev/vuln/GO-2021-0053"
            },
            "ecosystem_specific": {
              "imports": [
                {
                  "path": "github.com/gogo/protobuf/plugin/unmarshal",
                  "symbols": [
                    "unmarshal.Generate",
                    "unmarshal.field"
                  ]
                }
              ]
            },
            "package": {
              "ecosystem": "Go",
              "name": "github.com/gogo/protobuf",
              "purl": "pkg:golang/github.com/gogo/protobuf"
            },
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "1.3.2"
                  }
                ],
                "type": "SEMVER"
              }
            ]
          }
        ],
        "aliases": [
          "CVE-2021-3121",
          "GHSA-c3h9-896r-86jm"
        ],
        "details": "Due to improper bounds checking, maliciously crafted input to generated Unmarshal methods can cause an out-of-bounds panic. If parsing messages from untrusted parties, this may be used as a denial of service vector.",
        "id": "GO-2021-0053",
        "modified": "2023-02-10T16:51:38Z",
        "published": "2021-04-14T20:04:52Z",
        "references": [
          {
            "type": "FIX",
            "url": "https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc"
          }
        ],
        "schema_version": "1.3.0",
        "summary": ""
      }
    ]
  },
  {
    "groups": [
      {
        "experimentalAnalysis": {
          "GO-2023-1558": {
            "called": true
          }
        },
        "ids": [
          "GHSA-2h6c-j3gf-xp9r",
          "GO-2023-1558"
        ]
      }
    ],
    "package": {
      "ecosystem": "Go",
      "name": "github.com/ipfs/go-bitfield",
      "version": "1.0.0"
    },
    "vulnerabilities": [
      {
        "affected": [
          {
            "database_specific": {
              "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-2h6c-j3gf-xp9r/GHSA-2h6c-j3gf-xp9r.json"
            },
            "package": {
              "ecosystem": "Go",
              "name": "github.com/ipfs/go-bitfield",
              "purl": "pkg:golang/github.com/ipfs/go-bitfield"
            },
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "1.0.0"
                  },
                  {
                    "fixed": "1.1.0"
                  }
                ],
                "type": "SEMVER"
              }
            ],
            "versions": [
              "1.0.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2023-23626"
        ],
        "database_specific": {
          "cwe_ids": [
            "CWE-1284",
            "CWE-754"
          ],
          "github_reviewed": true,
          "github_reviewed_at": "2023-02-10T19:52:45Z",
          "nvd_published_at": "2023-02-09T21:15:00Z",
          "severity": "MODERATE"
        },
        "details": "### Impact\nWhen feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s.\n\nThis happen when the `size` is a not a multiple of `8` or is negative.\nThere were already a note in the `NewBitfield` documentation:\n\u003e ```\n\u003e Panics if size is not a multiple of 8.\n\u003e ````\n\nBut it incomplete and missing from `FromBytes`'s documentation.\n\nThis has been replaced by returning an `(Bitfield, error)` and returning a non nil error if the size is wrong.\n\n### Patches\n- https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e579\n\n### Workarounds\n- Ensure `size%8 == 0 \u0026\u0026 size \u003e= 0` yourself before calling `NewBitfield` or `FromBytes`\n\n### References\n- https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778\n",
        "id": "GHSA-2h6c-j3gf-xp9r",
        "modified": "2023-02-10T19:52:45Z",
        "published": "2023-02-10T19:52:45Z",
        "references": [
          {
            "type": "WEB",
            "url": "https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r"
          },
          {
            "type": "ADVISORY",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23626"
          },
          {
            "type": "WEB",
            "url": "https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e579"
          },
          {
            "type": "PACKAGE",
            "url": "https://github.com/ipfs/go-bitfield"
          },
          {
            "type": "WEB",
            "url": "https://pkg.go.dev/vuln/GO-2023-1558"
          }
        ],
        "schema_version": "1.3.0",
        "summary": "IPFS go-bitfield vulnerable to DoS via malformed size arguments"
      },
      {
        "affected": [
          {
            "database_specific": {
              "source": "https://vuln.go.dev/ID/GO-2023-1558.json",
              "url": "https://pkg.go.dev/vuln/GO-2023-1558"
            },
            "ecosystem_specific": {
              "imports": [
                {
                  "path": "github.com/ipfs/go-bitfield",
                  "symbols": [
                    "FromBytes",
                    "NewBitfield"
                  ]
                }
              ]
            },
            "package": {
              "ecosystem": "Go",
              "name": "github.com/ipfs/go-bitfield",
              "purl": "pkg:golang/github.com/ipfs/go-bitfield"
            },
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "1.1.0"
                  }
                ],
                "type": "SEMVER"
              }
            ]
          }
        ],
        "aliases": [
          "CVE-2023-23626",
          "GHSA-2h6c-j3gf-xp9r"
        ],
        "details": "When feeding untrusted user input into the size parameter of `NewBitfield` and FromBytes functions, an attacker can trigger panics.\n\nThis happens when the size is a not a multiple of 8 or is negative.\n\nA workaround is to ensure size%8 == 0 \u0026\u0026 size \u003e= 0 yourself before calling NewBitfield or FromBytes.",
        "id": "GO-2023-1558",
        "modified": "2023-02-14T19:41:21Z",
        "published": "2023-02-14T19:41:21Z",
        "references": [
          {
            "type": "ADVISORY",
            "url": "https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r"
          },
          {
            "type": "FIX",
            "url": "https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e579"
          }
        ],
        "schema_version": "1.3.0",
        "summary": ""
      }
    ]
  },
  {
    "groups": [
      {
        "experimentalAnalysis": {
          "GO-2023-1572": {
            "called": false
          }
        },
        "ids": [
          "GHSA-qgc7-mgm3-q253",
          "GO-2023-1572"
        ]
      }
    ],
    "package": {
      "ecosystem": "Go",
      "name": "golang.org/x/image",
      "version": "0.4.0"
    },
    "vulnerabilities": [
      {
        "affected": [
          {
            "database_specific": {
              "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-qgc7-mgm3-q253/GHSA-qgc7-mgm3-q253.json"
            },
            "package": {
              "ecosystem": "Go",
              "name": "golang.org/x/image",
              "purl": "pkg:golang/golang.org/x/image"
            },
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "0.5.0"
                  }
                ],
                "type": "SEMVER"
              }
            ]
          }
        ],
        "aliases": [
          "CVE-2022-41727"
        ],
        "database_specific": {
          "cwe_ids": [
            "CWE-400"
          ],
          "github_reviewed": true,
          "github_reviewed_at": "2023-02-17T13:59:44Z",
          "nvd_published_at": null,
          "severity": "LOW"
        },
        "details": "An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.",
        "id": "GHSA-qgc7-mgm3-q253",
        "modified": "2023-02-17T13:59:44Z",
        "published": "2023-02-17T13:59:44Z",
        "references": [
          {
            "type": "ADVISORY",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41727"
          },
          {
            "type": "WEB",
            "url": "https://go.dev/cl/468195"
          },
          {
            "type": "WEB",
            "url": "https://go.dev/issue/58003"
          },
          {
            "type": "WEB",
            "url": "https://groups.google.com/g/golang-announce/c/ag-FiyjlD5o"
          },
          {
            "type": "WEB",
            "url": "https://pkg.go.dev/vuln/GO-2023-1572"
          }
        ],
        "schema_version": "1.3.0",
        "summary": "Uncontrolled Resource Consumption"
      },
      {
        "affected": [
          {
            "database_specific": {
              "source": "https://vuln.go.dev/ID/GO-2023-1572.json",
              "url": "https://pkg.go.dev/vuln/GO-2023-1572"
            },
            "ecosystem_specific": {
              "imports": [
                {
                  "path": "golang.org/x/image/tiff",
                  "symbols": [
                    "Decode",
                    "DecodeConfig",
                    "decoder.ifdUint",
                    "newDecoder"
                  ]
                }
              ]
            },
            "package": {
              "ecosystem": "Go",
              "name": "golang.org/x/image",
              "purl": "pkg:golang/golang.org/x/image"
            },
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "0.5.0"
                  }
                ],
                "type": "SEMVER"
              }
            ]
          }
        ],
        "aliases": [
          "CVE-2022-41727"
        ],
        "details": "An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.",
        "id": "GO-2023-1572",
        "modified": "2023-02-16T22:25:24Z",
        "published": "2023-02-16T22:25:24Z",
        "references": [
          {
            "type": "REPORT",
            "url": "https://go.dev/issue/58003"
          },
          {
            "type": "FIX",
            "url": "https://go.dev/cl/468195"
          },
          {
            "type": "WEB",
            "url": "https://groups.google.com/g/golang-announce/c/ag-FiyjlD5o"
          }
        ],
        "schema_version": "1.3.0",
        "summary": ""
      }
    ]
  }
]