REDHAT-BUG-2295010: High severity gorilla schema vulnerability
gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2295010?
The vulnerability REDHAT-BUG-2295010 is considered critical due to its exploitation potential leading to significant security breaches.
How do I fix REDHAT-BUG-2295010?
To fix REDHAT-BUG-2295010, upgrade the Gorilla schema to version 1.4.1 or later.
What versions of Gorilla schema are affected by REDHAT-BUG-2295010?
Versions of Gorilla schema prior to 1.4.1 are affected by REDHAT-BUG-2295010.
How does REDHAT-BUG-2295010 affect memory allocation?
REDHAT-BUG-2295010 allows attackers to exploit the sparse slice functionality, which can lead to improper memory allocation.
Is the vulnerability REDHAT-BUG-2295010 publicly known?
Yes, REDHAT-BUG-2295010 is publicly reported and documented in Red Hat's bug tracking system.