927498 – (CVE-2024-24786) [Tracker] Podman BuildKit infinite loop when unmarshaling certain forms of invalid JSON

Bug 927498 (CVE-2024-24786) - [Tracker] Podman BuildKit infinite loop when unmarshaling certain forms of invalid JSON

Summary: [Tracker] Podman BuildKit infinite loop when unmarshaling certain forms of in...

Status:	RESOLVED FIXED

Alias:	CVE-2024-24786

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal
Assignee:	Gentoo Security

URL:
Whiteboard:
Keywords:	SECURITY, Tracker

Depends on:	927499 927500
Blocks:
	Show dependency tree

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Rahil Bhimjiani 2024-03-22 10:18:04 UTC

Any Golang package with <1.33.0 of google.golang.org/protobuf in go.mod is affected.

https://github.com/advisories/GHSA-8r3f-844c-mc37