VDB
Sign up
HIGH

GHSA-84vh-m24q-wjjx

Pocketbase: Unhandled panic in worker goroutines

Quick fix

GHSA-84vh-m24q-wjjx — github.com/pocketbase/pocketbase: upgrade to the fixed version with the command below.

go get github.com/pocketbase/pocketbase@v0.22.48

Details

PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process.

To prevent this from hapenning all existing internal worker functions were wrapped with the new helper `routine.SafeWrap(f)` _(auto recovers and returns any eventual panic as regular error)_.

The vulnerability was reported by @gigioneggiando and it is strongly recommended to upgrade to PocketBase **[v0.39.7](https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7)** _(the fix was also backported in [v0.22.48](https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48) in case you are using older PocketBase < v0.23.0)_.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/pocketbase/pocketbase
Introduced in: 0Fixed in: 0.22.48
Fixgo get github.com/pocketbase/pocketbase@v0.22.48
Go/github.com/pocketbase/pocketbase
Introduced in: 0.23.0Fixed in: 0.39.7
Fixgo get github.com/pocketbase/pocketbase@v0.39.7

References