GitHub Advisoryadvisory · Go

GHSA-gxhv-3hwf-wjp9 JSON-Patch Out-of-bounds Write vulnerability

HIGH Published 2022-05-13 Modified 2023-02-08 Official page ↗
Aliases
CVE-2018-14632
Ecosystem
Go
Packages
github.com/evanphx/json-patch
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-787
Reviewed
2023-02-08

Affected packages

• Go github.com/evanphx/json-patch: < 0.5.2 → fixed in 0.5.2 • Go github.com/evanphx/json-patch: >= 3.0.0, < 3.0.1-0.20180525145409-4c9aadca8f89 → fixed in 3.0.1-0.20180525145409-4c9aadca8f89

Description

An out of bound write can occur when patching an Openshift object using the `oc patch` functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.

Related

Alias · CVE (1)

  • CVE-2018-14632 An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before… vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References