CVE-2020-5234
Summary
| CVE | CVE-2020-5234 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-01-31 18:15:00 UTC |
|---|
| Updated | 2020-02-24 23:15:00 UTC |
|---|
| Description | MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Untrusted data can lead to DoS attack due to hash collisions and stack overflow · Advisory · neuecc/MessagePack-CSharp · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| MessagePackSecurity.GetEqualityComparer<object> returns null on copied instances · Issue #810 · neuecc/MessagePack-CSharp · GitHub |
MISC |
github.com |
|
| Merge security fixes in for v2.1 · neuecc/MessagePack-CSharp@56fa862 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Merge pull request #811 from AArnott/fixNullHasher · neuecc/MessagePack-CSharp@f886840 · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 982818 Dotnet (nuget) Security Update for MessagePack.UnityShims (GHSA-7q36-4xx7-xcxf)
