CVE-2024-24786

Name	CVE-2024-24786
Description	The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1065684

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-google-protobuf (PTS)	bullseye	1.25.0+git20201208.160c747-1	vulnerable
	bookworm	1.28.1-3	vulnerable
	trixie	1.36.5-1	fixed
	forky, sid	1.36.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-google-protobuf	source	(unstable)	1.33.0-1			1065684

Notes

[bookworm] - golang-google-protobuf <no-dsa> (Minor issue)
[bullseye] - golang-google-protobuf <no-dsa> (Minor issue)
https://go-review.googlesource.com/c/protobuf/+/569356