bazelbuild / bazelbuild/rules_android
Possible fix(deps): google.golang.org/protobuf v1.31.0 → 1.33.0 (CVE-2024-24786) in go.mod
- Dominant language
- Java
- Stars
- 203
- Forks
- 95
- PR merge metrics
- No merged PRs in 30d
Description
Spotted what might be an issue in `go.mod` around line 1.
The project pins google.golang.org/protobuf at v1.31.0. In this version, `protojson.Unmarshal` may enter an infinite loop when processing malformed JSON (e.g., messages containing a `google.protobuf.Any` field or when `UnmarshalOptions.DiscardUnknown` is enabled). An attacker can cause a denial‑of‑service by supplying crafted JSON that never returns, leading to high availability risk. The vulnerability is classified as CVE‑2024‑24786 with a MEDIUM severity in the scanner but effectively a high risk due to the potential DoS. Updating to version 1.33.0 (or later) resolves the loop bug.
Something like this might fix it:
```
*** Begin Patch
*** Update File: go.mod
@@
-require google.golang.org/protobuf v1.31.0
+// Updated to include the fix for CVE‑2024‑24786 (infinite‑loop in protojson.Unmarshal)
+require google.golang.org/protobuf v1.33.0
*** End Patch
```
For reference: rule `CVE-2024-24786`. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*
Contributor guide
Assessment
This issue has not been assessed yet.