GHSA-pr85-w493-9w3x: Out-of-bounds Read
Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice.
Patches The bug has been patched starting with version 6.2.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/resdatato a version that resolves this vulnerability.Fixed in 6.2.9 - Upgrade
Upgrade
resdatato a version that resolves this vulnerability.Fixed in 6.2.9
Event History
Frequently Asked Questions
Which deployments are most exposed?
Systems that use resdata to parse untrusted GRDECL files are exposed, particularly when parsing occurs in a network-facing context such as a web service. The critical severity assessment assumes this deployment scenario.
What does an attacker need to exploit this issue?
An attacker needs to provide a malicious or malformed GRDECL file for resdata to parse. No privileges or user interaction are required under the stated severity vector.
What version fixes the vulnerability?
Upgrade resdata to version 6.2.9 or later, where the input-validation bug is patched.