Skip to content
OpenAdvisories
Medium · 4.8 CVE-2020-5234 EUVD-2020-0254GHSA-7q36-4xx7-xcxf

Untrusted data can lead to DoS attack in MessagePack for C# and Unity

Published Jan 31, 2020 · Updated Aug 4, 2024 · Assigned by GitHub_M

Vendor: neuecc Product: MessagePack Product: MessagePack.ImmutableCollection Product: MessagePack.ReactiveProperty Product: MessagePack.UnityShims Package: MessagePack Package: MessagePack.ImmutableCollection Package: MessagePack.ReactiveProperty Package: MessagePack.Unity Package: MessagePack.UnityShims Package: python-msgpack Ecosystem: Azure Linux Ecosystem: NuGet

Description

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

Affected products

VendorProductAffectedFixed
neuecc MessagePack < 1.9.11, >= 2.0.0, < 2.1.90 —
neuecc MessagePack.ImmutableCollection < 1.9.11, >= 2.0.0, < 2.1.90 —
neuecc MessagePack.ReactiveProperty < 1.9.11, >= 2.0.0, < 2.1.90 —
neuecc MessagePack.UnityShims < 1.9.11, >= 2.0.0, < 2.1.90 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-msgpack No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet MessagePack < 1.9.11 1.9.11 GHSA-7q36-4xx7-xcxf
NuGet MessagePack >= 2.0.0, < 2.1.90 2.1.90 GHSA-7q36-4xx7-xcxf
NuGet MessagePack.ImmutableCollection < 1.9.11 1.9.11 GHSA-7q36-4xx7-xcxf
NuGet MessagePack.ImmutableCollection >= 2.0.0, < 2.1.90 2.1.90 GHSA-7q36-4xx7-xcxf
NuGet MessagePack.ReactiveProperty < 1.9.11 1.9.11 GHSA-7q36-4xx7-xcxf
NuGet MessagePack.ReactiveProperty >= 2.0.0, < 2.1.90 2.1.90 GHSA-7q36-4xx7-xcxf
NuGet MessagePack.Unity < 1.9.11 1.9.11 GHSA-7q36-4xx7-xcxf
NuGet MessagePack.Unity >= 2.0.0, < 2.1.90 2.1.90 GHSA-7q36-4xx7-xcxf
NuGet MessagePack.UnityShims < 1.9.11 1.9.11 GHSA-7q36-4xx7-xcxf
NuGet MessagePack.UnityShims >= 2.0.0, < 2.1.90 2.1.90 GHSA-7q36-4xx7-xcxf

References