CVE-2023-37475

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Jul 17, 2023
Updated: Jul 26, 2023
CWE ID 400

Summary

CVE-2023-37475 is a denial-of-service vulnerability affecting Hamba avro's Go lang implementation of the Avro codec specification. A maliciously crafted string input to `github.com/hamba/avro/v2.Unmarshal()` can cause an unrecoverable "out of memory" error, consuming arbitrary amounts of memory and leading to application crashes. This issue arises because avro utilizes a portion of the input to `Unmarshal()` to determine the size when creating a new slice, making it susceptible to memory exhaustion attacks. The vulnerability has been mitigated by commit `b4a402f4`, which is part of release version `2.13.0`. Users are strongly advised to upgrade as soon as possible, with no known workarounds available.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share