GitHub Advisoryadvisory · Go

GHSA-4cxw-hq44-r344 Off-by-one Error in v2fly/v2ray-core

CRITICAL Published 2022-02-24 Modified 2022-03-03 Official page ↗
Aliases
CVE-2021-4070
Ecosystem
Go
Packages
github.com/v2fly/v2ray-core/v4, github.com/v2fly/v2ray-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-193
Reviewed
2022-02-24

Affected packages

• Go github.com/v2fly/v2ray-core/v4: < 4.44.0 → fixed in 4.44.0 • Go github.com/v2fly/v2ray-core: < 4.44.0 (no fix yet)

Description

v2fly/v2ray-core prior to 4.44.0 is vulnerable to an off-by-one error. Indexing operations on arrays, slices, or strings should use an index at most one less than the length. If the index is checked for being less than or equal to the length (`<=`), instead of less than the length (`<`), the index could be out of bounds.

Related

Alias · CVE (1)

  • CVE-2021-4070 Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0. vulnerability

Weakness · CWE (1)

  • CWE-193 Off-by-one Error weakness

References