CVE-2023-23626: Improper Check for Unusual or Exceptional Conditions
(updated )
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of NewBitfield
and FromBytes
functions, an attacker can trigger panic
s. This happen when the size
is a not a multiple of 8
or is negative. There were already a note in the NewBitfield
documentation, however known users of this package are subject to this issue. Users are advised to upgrade. Users unable to upgrade should ensure that size
is a multiple of 8 before calling NewBitfield
or FromBytes
.
References
Detect and mitigate CVE-2023-23626 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →