—

GO-2021-0076

Out-of-bounds write in github.com/evanphx/json-patch

Quick fix

GO-2021-0076 — github.com/evanphx/json-patch: upgrade to the fixed version with the command below.

go get github.com/evanphx/json-patch@v0.5.2

Details

A malicious JSON patch can cause a panic due to an out-of-bounds write attempt. This can be used as a denial of service vector if exposed to arbitrary user input.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/evanphx/json-patch

Introduced in: 0Fixed in: 0.5.2

Fixgo get github.com/evanphx/json-patch@v0.5.2

References

https://github.com/evanphx/json-patch/pull/57[FIX]
https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03[FIX]