CVE-2021-39293 - log back

CVE-2021-39293 edited at 09 Sep 2021 19:35:51
Severity
- Unknown
+ Low
Remote
- Unknown
+ Remote
Type
- Unknown
+ Denial of service
Description
+ A security issue has been found in go before version 1.17.1. An oversight in the fix for CVE-2021-33196 still allows for an out of memory panic when the indicated directory size in the archive header is so large that subtracting it from the archive size overflows a uint64, effectively bypassing the check that the number of files in the archive is reasonable.
References
+ https://groups.google.com/g/golang-announce/c/dx9d7IOseHw
+ https://github.com/golang/go/issues/47801
+ https://github.com/golang/go/commit/1dd24caf08985066b309af6bc461780c73e05c35
Notes
CVE-2021-39293 created at 09 Sep 2021 19:32:21