MEDIUM 5.5
GHSA-q6hh-gp44-4hcm
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Quick fix
GHSA-q6hh-gp44-4hcm — github.com/pterodactyl/wings: upgrade to the fixed version with the command below.
go get github.com/pterodactyl/wings@v1.13.0Details
### Summary Config file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.
### Impact All wings users who have an egg with a non-`file` parser configuration file setting.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/pterodactyl/wings
Introduced in:
0 Fixed in: 1.13.0 Fix
go get github.com/pterodactyl/wings@v1.13.0