Skip to content

Commit a3ba6c6

Browse files
timothy-kingtimothy-king
committed
data/reports: add GO-2024-2826.yaml
Aliases: CVE-2024-32886, GHSA-649x-hxfx-57j2 Fixes #2826 Change-Id: I6ed71a1ba6370f517ae7fdce8eccf608d93db326 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/584257 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]>
1 parent fe9f8b1 commit a3ba6c6

File tree

2 files changed

+329
-0
lines changed

2 files changed

+329
-0
lines changed

‎data/osv/GO-2024-2826.json

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2826",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-32886",
8+
"GHSA-649x-hxfx-57j2"
9+
],
10+
"summary": "Denial of service attack by triggering unbounded memory usage in vitess.io/vitess",
11+
"details": "When executing a query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. This causes a denial of service.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "vitess.io/vitess",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.17.7"
27+
},
28+
{
29+
"introduced": "0.18.0"
30+
},
31+
{
32+
"fixed": "0.18.5"
33+
},
34+
{
35+
"introduced": "0.19.0"
36+
},
37+
{
38+
"fixed": "0.19.4"
39+
}
40+
]
41+
}
42+
],
43+
"ecosystem_specific": {
44+
"imports": [
45+
{
46+
"path": "vitess.io/vitess/go/mysql/collations/charset",
47+
"symbols": [
48+
"Convert",
49+
"ConvertFromBinary",
50+
"ConvertFromUTF8",
51+
"Validate",
52+
"convertSlow"
53+
]
54+
},
55+
{
56+
"path": "vitess.io/vitess/go/mysql/collations/charset/unicode",
57+
"symbols": [
58+
"Charset_ucs2.DecodeRune",
59+
"Charset_utf16be.DecodeRune",
60+
"Charset_utf16be.EncodeRune",
61+
"Charset_utf32.EncodeRune"
62+
]
63+
},
64+
{
65+
"path": "vitess.io/vitess/go/vt/vtgate/evalengine",
66+
"symbols": [
67+
"Add",
68+
"AggregateEvalTypes",
69+
"CoerceTo",
70+
"CoerceTypes",
71+
"Column.Format",
72+
"Column.FormatFast",
73+
"Comparison.ApplyTinyWeights",
74+
"Comparison.Compare",
75+
"Comparison.Less",
76+
"Comparison.More",
77+
"Comparison.Sort",
78+
"Comparison.SortResult",
79+
"CompiledExpr.Format",
80+
"CompiledExpr.FormatFast",
81+
"Divide",
82+
"EvalResult.MustBoolean",
83+
"EvalResult.String",
84+
"EvalResult.ToBoolean",
85+
"EvalResult.ToBooleanStrict",
86+
"EvalResult.TupleValues",
87+
"EvalResult.Value",
88+
"ExpressionEnv.Evaluate",
89+
"ExpressionEnv.EvaluateVM",
90+
"FieldResolver.Column",
91+
"IntroducerExpr.eval",
92+
"Literal.Format",
93+
"Literal.FormatFast",
94+
"Merger.Init",
95+
"Merger.Pop",
96+
"Merger.Push",
97+
"Multiply",
98+
"NewLiteralBinaryFromBit",
99+
"NewLiteralDateFromBytes",
100+
"NewLiteralDatetimeFromBytes",
101+
"NewLiteralDecimalFromBytes",
102+
"NewLiteralFloatFromBytes",
103+
"NewLiteralIntegralFromBytes",
104+
"NewLiteralTimeFromBytes",
105+
"NullSafeAdd",
106+
"NullsafeCompare",
107+
"NullsafeHashcode",
108+
"NullsafeHashcode128",
109+
"OrderByParams.Compare",
110+
"OrderByParams.String",
111+
"Sorter.Push",
112+
"Sorter.Sorted",
113+
"Subtract",
114+
"Translate",
115+
"TupleBindVariable.Format",
116+
"TupleBindVariable.FormatFast",
117+
"TupleExpr.Format",
118+
"TupleExpr.FormatFast",
119+
"UnsupportedCollationError.Error",
120+
"UntypedExpr.Compile",
121+
"UntypedExpr.Format",
122+
"UntypedExpr.FormatFast",
123+
"WeightString",
124+
"aggregationDecimal.Add",
125+
"aggregationDecimal.Max",
126+
"aggregationDecimal.Min",
127+
"aggregationFloat.Add",
128+
"aggregationFloat.Max",
129+
"aggregationFloat.Min",
130+
"aggregationInt.Add",
131+
"aggregationInt.Max",
132+
"aggregationInt.Min",
133+
"aggregationMinMax.Max",
134+
"aggregationMinMax.Min",
135+
"aggregationSumAny.Add",
136+
"aggregationSumCount.Add",
137+
"aggregationUint.Add",
138+
"aggregationUint.Max",
139+
"aggregationUint.Min",
140+
"argError.Error",
141+
"assembler.Fn_JSON_KEYS",
142+
"assembler.Fn_REGEXP_REPLACE_slow",
143+
"assembler.PushLiteral",
144+
"astCompiler.translateIntroducerExpr",
145+
"errJSONType.Error",
146+
"evalBytes.Hash"
147+
]
148+
}
149+
]
150+
}
151+
}
152+
],
153+
"references": [
154+
{
155+
"type": "ADVISORY",
156+
"url": "https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2"
157+
},
158+
{
159+
"type": "FIX",
160+
"url": "https://github.com/vitessio/vitess/commit/2fd5ba1dbf6e9b32fdfdaf869d130066b1b5c0df"
161+
},
162+
{
163+
"type": "FIX",
164+
"url": "https://github.com/vitessio/vitess/commit/9df4b66550e46b5d7079e21ed0e1b0f49f92b055"
165+
},
166+
{
167+
"type": "FIX",
168+
"url": "https://github.com/vitessio/vitess/commit/c46dc5b6a4329a10589ca928392218d96031ac8d"
169+
},
170+
{
171+
"type": "FIX",
172+
"url": "https://github.com/vitessio/vitess/commit/d438adf7e34a6cf00fe441db80842ec669a99202"
173+
},
174+
{
175+
"type": "WEB",
176+
"url": "https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/convert.go#L73-L79"
177+
},
178+
{
179+
"type": "WEB",
180+
"url": "https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/unicode/utf16.go#L69-L71"
181+
}
182+
],
183+
"credits": [
184+
{
185+
"name": "@dbussink, @mattrobenolt, and @vmg"
186+
}
187+
],
188+
"database_specific": {
189+
"url": "https://pkg.go.dev/vuln/GO-2024-2826"
190+
}
191+
}

‎data/reports/GO-2024-2826.yaml

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
id: GO-2024-2826
2+
modules:
3+
- module: vitess.io/vitess
4+
versions:
5+
- fixed: 0.17.7
6+
- introduced: 0.18.0
7+
fixed: 0.18.5
8+
- introduced: 0.19.0
9+
fixed: 0.19.4
10+
non_go_versions:
11+
- fixed: 17.0.7
12+
- introduced: 18.0.0
13+
fixed: 18.0.5
14+
- introduced: 19.0.0
15+
fixed: 19.0.4
16+
vulnerable_at: 0.19.0
17+
packages:
18+
- package: vitess.io/vitess/go/mysql/collations/charset
19+
symbols:
20+
- convertSlow
21+
- Validate
22+
derived_symbols:
23+
- Convert
24+
- ConvertFromBinary
25+
- ConvertFromUTF8
26+
- package: vitess.io/vitess/go/mysql/collations/charset/unicode
27+
symbols:
28+
- Charset_utf16be.EncodeRune
29+
- Charset_utf16be.DecodeRune
30+
- Charset_ucs2.DecodeRune
31+
- Charset_utf32.EncodeRune
32+
- package: vitess.io/vitess/go/vt/vtgate/evalengine
33+
symbols:
34+
- assembler.Fn_REGEXP_REPLACE_slow
35+
- IntroducerExpr.eval
36+
- astCompiler.translateIntroducerExpr
37+
derived_symbols:
38+
- Add
39+
- AggregateEvalTypes
40+
- CoerceTo
41+
- CoerceTypes
42+
- Column.Format
43+
- Column.FormatFast
44+
- Comparison.ApplyTinyWeights
45+
- Comparison.Compare
46+
- Comparison.Less
47+
- Comparison.More
48+
- Comparison.Sort
49+
- Comparison.SortResult
50+
- CompiledExpr.Format
51+
- CompiledExpr.FormatFast
52+
- Divide
53+
- EvalResult.MustBoolean
54+
- EvalResult.String
55+
- EvalResult.ToBoolean
56+
- EvalResult.ToBooleanStrict
57+
- EvalResult.TupleValues
58+
- EvalResult.Value
59+
- ExpressionEnv.Evaluate
60+
- ExpressionEnv.EvaluateVM
61+
- FieldResolver.Column
62+
- Literal.Format
63+
- Literal.FormatFast
64+
- Merger.Init
65+
- Merger.Pop
66+
- Merger.Push
67+
- Multiply
68+
- NewLiteralBinaryFromBit
69+
- NewLiteralDateFromBytes
70+
- NewLiteralDatetimeFromBytes
71+
- NewLiteralDecimalFromBytes
72+
- NewLiteralFloatFromBytes
73+
- NewLiteralIntegralFromBytes
74+
- NewLiteralTimeFromBytes
75+
- NullSafeAdd
76+
- NullsafeCompare
77+
- NullsafeHashcode
78+
- NullsafeHashcode128
79+
- OrderByParams.Compare
80+
- OrderByParams.String
81+
- Sorter.Push
82+
- Sorter.Sorted
83+
- Subtract
84+
- Translate
85+
- TupleBindVariable.Format
86+
- TupleBindVariable.FormatFast
87+
- TupleExpr.Format
88+
- TupleExpr.FormatFast
89+
- UnsupportedCollationError.Error
90+
- UntypedExpr.Compile
91+
- UntypedExpr.Format
92+
- UntypedExpr.FormatFast
93+
- WeightString
94+
- aggregationDecimal.Add
95+
- aggregationDecimal.Max
96+
- aggregationDecimal.Min
97+
- aggregationFloat.Add
98+
- aggregationFloat.Max
99+
- aggregationFloat.Min
100+
- aggregationInt.Add
101+
- aggregationInt.Max
102+
- aggregationInt.Min
103+
- aggregationMinMax.Max
104+
- aggregationMinMax.Min
105+
- aggregationSumAny.Add
106+
- aggregationSumCount.Add
107+
- aggregationUint.Add
108+
- aggregationUint.Max
109+
- aggregationUint.Min
110+
- argError.Error
111+
- assembler.Fn_JSON_KEYS
112+
- assembler.PushLiteral
113+
- errJSONType.Error
114+
- evalBytes.Hash
115+
summary: |-
116+
Denial of service attack by triggering unbounded memory usage in
117+
vitess.io/vitess
118+
description: |-
119+
When executing a query, the vtgate will go into an endless
120+
loop that also keeps consuming memory and eventually will OOM.
121+
This causes a denial of service.
122+
cves:
123+
- CVE-2024-32886
124+
ghsas:
125+
- GHSA-649x-hxfx-57j2
126+
credits:
127+
- '@dbussink, @mattrobenolt, and @vmg'
128+
references:
129+
- advisory: https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2
130+
- fix: https://github.com/vitessio/vitess/commit/2fd5ba1dbf6e9b32fdfdaf869d130066b1b5c0df
131+
- fix: https://github.com/vitessio/vitess/commit/9df4b66550e46b5d7079e21ed0e1b0f49f92b055
132+
- fix: https://github.com/vitessio/vitess/commit/c46dc5b6a4329a10589ca928392218d96031ac8d
133+
- fix: https://github.com/vitessio/vitess/commit/d438adf7e34a6cf00fe441db80842ec669a99202
134+
- web: https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/convert.go#L73-L79
135+
- web: https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/unicode/utf16.go#L69-L71
136+
source:
137+
id: GHSA-649x-hxfx-57j2
138+
created: 2024-05-10T11:07:07.249403-07:00

0 commit comments

Comments
 (0)