Home > Vulnerability Database > CVE-2021-3121

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2021-3121

Good to know:

Date: January 11, 2021

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

Language: Go

Severity Score

8.6

Related Resources (15)

Url: https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E

Url: https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44%40%3Ccommits.pulsar.apache.org%3E

Url: https://security.netapp.com/advisory/ntap-20210219-0006/

Url: https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E

Url: https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc

Url: https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E

Url: https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E

Url: https://pkg.go.dev/vuln/GO-2021-0053

Url: https://github.com/gogo/protobuf

Url: https://security.netapp.com/advisory/ntap-20210219-0006

Url: https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025

Url: https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e%40%3Ccommits.pulsar.apache.org%3E

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-3121

Url: https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2

Url: https://www.mend.io/vulnerability-database/CVE-2021-3121

Severity Score

8.6

Weakness Type (CWE)

Improper Validation of Array Index

CWE-129

Input Validation

CWE-20

Top Fix

Upgrade Version

Upgrade to version v1.3.2

CVSS v3.1

Base Score:	8.6
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	HIGH

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us