x/vulndb: potential Go vuln in github.com/hamba/avro: CVE-2023-37475

[GoVulnBot]

CVE-2023-37475 references github.com/hamba/avro, which may be a Go module.

Description:
Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal() can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to Unmarshal() to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash. This issue has been addressed in commit b4a402f4 which has been included in release version 2.13.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-37475
• JSON: https://github.com/CVEProject/cvelist/tree/4d8c051308ee1ce2ec79c764aa3a6bbc59f330f3/2023/37xxx/CVE-2023-37475.json
• advisory: GHSA-9x44-9pgq-cf45
• fix: hamba/avro@b4a402f
• Imported by: https://pkg.go.dev/github.com/hamba/avro?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/hamba/avro
      vulnerable_at: 1.8.0
      packages:
        - package: avro
description: |-
    Hamba avro is a go lang encoder/decoder implementation of the avro codec
    specification. In affected versions a well-crafted string passed to avro's
    `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of
    memory` which is unrecoverable and can cause denial of service of the consumer
    of avro. The root cause of the issue is that avro uses part of the input to
    `Unmarshal()` to determine the size when creating a new slice and hence an
    attacker may consume arbitrary amounts of memory which in turn may cause the
    application to crash. This issue has been addressed in commit `b4a402f4` which
    has been included in release version `2.13.0`. Users are advised to upgrade.
    There are no known workarounds for this vulnerability.
cves:
    - CVE-2023-37475
references:
    - advisory: https://github.com/hamba/avro/security/advisories/GHSA-9x44-9pgq-cf45
    - fix: https://github.com/hamba/avro/commit/b4a402f41cf44b6094b5131286830ba9bb1eb290

[neild]

Duplicate of #1930