GHSA-f99h-w337-mv56 Panic when parsing ranges with invalid masks in github.com/malfunkt/iprange
An attacker can cause a denial of service by providing an IP range with an invalid mask larger than 32 bits to the iprange library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-f99h-w337-mv56?
GHSA-f99h-w337-mv56 is a denial of service vulnerability in github.com/malfunkt/iprange, published on 11 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Which versions are affected by GHSA-f99h-w337-mv56?
3 open source packages ship an affected version, including github.com/malfunkt/iprange.
| Package | Affected | Fixed in |
|---|---|---|
github.com/malfunkt/iprange Go | All versions | None |
github.com/malfunkt/iprange Go | All versions to 0.9.0 | None |
github.com/malfunkt/iprange Go | All versions to 0.9.0 | None |
How do I fix GHSA-f99h-w337-mv56?
No fix has been published for GHSA-f99h-w337-mv56 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-f99h-w337-mv56 being exploited?
There is no known exploitation of GHSA-f99h-w337-mv56 in the wild and no public exploit code.
Sources
Also known as GO-2023-1857.