Vulnerabilities > CVE-2021-3121 - Improper Validation of Array Index vulnerability in multiple products

CVSS 8.6 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

HIGH

network

low complexity

golang

hashicorp

CWE-129

NVD

Published: 2021-01-11

Updated: 2023-11-07

Summary

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

Vulnerable Configurations

Part	Description	Count
Application	Golang Golang Protobuf 0.1 Golang Protobuf 0.2 Golang Protobuf 0.3 Golang Protobuf 0.4 Golang Protobuf 0.5 Golang Protobuf 1.0.0 Golang Protobuf 1.1.0 Golang Protobuf 1.1.1 Golang Protobuf 1.2.0 Golang Protobuf 1.2.1 Golang Protobuf 1.3.0 Golang Protobuf 1.3.1	12
Application	Hashicorp Hashicorp Consul 1.10.0 Hashicorp Consul 1.10.1 Hashicorp Consul 1.9.0 Hashicorp Consul 1.9.1 Hashicorp Consul 1.9.2 Hashicorp Consul 1.9.3 Hashicorp Consul 1.9.4 Hashicorp Consul 1.9.5 Hashicorp Consul 1.9.6 Hashicorp Consul 1.9.7 Hashicorp Consul 1.9.8 Hashicorp Consul - Hashicorp Consul 0.1.0 Hashicorp Consul 0.1.1 Hashicorp Consul 0.2.0 Hashicorp Consul 0.2.1 Hashicorp Consul 0.3.0 Hashicorp Consul 0.3.1 Hashicorp Consul 0.4.0 Hashicorp Consul 0.4.1 Hashicorp Consul 0.5.0 Hashicorp Consul 0.5.1 Hashicorp Consul 0.5.2 Hashicorp Consul 0.6.0 Hashicorp Consul 0.6.1 Hashicorp Consul 0.6.2 Hashicorp Consul 0.6.3 Hashicorp Consul 0.6.4 Hashicorp Consul 0.6.5 Hashicorp Consul 0.7.0 Hashicorp Consul 0.7.1 Hashicorp Consul 0.7.2 Hashicorp Consul 0.7.3 Hashicorp Consul 0.7.4 Hashicorp Consul 0.7.5 Hashicorp Consul 0.8.0 Hashicorp Consul 0.8.1 Hashicorp Consul 0.8.2 Hashicorp Consul 0.8.3 Hashicorp Consul 0.8.4 Hashicorp Consul 0.8.5 Hashicorp Consul 0.9.0 Hashicorp Consul 0.9.1 Hashicorp Consul 0.9.2 Hashicorp Consul 0.9.3 Hashicorp Consul 0.9.4 Hashicorp Consul 0.10.0 Hashicorp Consul 0.11.0 Hashicorp Consul 0.12.0 Hashicorp Consul 0.12.1 Hashicorp Consul 0.12.2 Hashicorp Consul 0.13.0 Hashicorp Consul 0.14.0 Hashicorp Consul 0.15.0 Hashicorp Consul 0.16.0 Hashicorp Consul 0.18.0 Hashicorp Consul 0.18.2 Hashicorp Consul 0.18.3 Hashicorp Consul 0.18.4 Hashicorp Consul 0.18.5 Hashicorp Consul 0.19.0 Hashicorp Consul 0.19.1 Hashicorp Consul 0.19.2 Hashicorp Consul 0.19.3 Hashicorp Consul 0.19.4 Hashicorp Consul 0.20.0 Hashicorp Consul 1.0.0 Hashicorp Consul 1.0.1 Hashicorp Consul 1.0.2 Hashicorp Consul 1.0.3 Hashicorp Consul 1.0.4 Hashicorp Consul 1.0.5 Hashicorp Consul 1.0.6 Hashicorp Consul 1.0.7 Hashicorp Consul 1.0.8 Hashicorp Consul 1.1.0 Hashicorp Consul 1.1.1 Hashicorp Consul 1.2.0 Hashicorp Consul 1.2.1 Hashicorp Consul 1.2.2 Hashicorp Consul 1.2.3 Hashicorp Consul 1.2.4 Hashicorp Consul 1.3.0 Hashicorp Consul 1.3.1 Hashicorp Consul 1.4.0 Hashicorp Consul 1.4.1 Hashicorp Consul 1.4.2 Hashicorp Consul 1.4.3 Hashicorp Consul 1.4.4 Hashicorp Consul 1.4.5 Hashicorp Consul 1.5.0 Hashicorp Consul 1.5.1 Hashicorp Consul 1.5.2 Hashicorp Consul 1.5.3 Hashicorp Consul 1.6.0 Hashicorp Consul 1.6.1 Hashicorp Consul 1.6.2 Hashicorp Consul 1.6.3 Hashicorp Consul 1.6.4 Hashicorp Consul 1.6.5 Hashicorp Consul 1.6.6 Hashicorp Consul 1.6.7 Hashicorp Consul 1.6.8 Hashicorp Consul 1.6.9 Hashicorp Consul 1.6.10 Hashicorp Consul 1.7.0 Hashicorp Consul 1.7.1 Hashicorp Consul 1.7.2 Hashicorp Consul 1.7.3 Hashicorp Consul 1.7.4 Hashicorp Consul 1.7.5 Hashicorp Consul 1.7.6 Hashicorp Consul 1.7.7 Hashicorp Consul 1.7.8 Hashicorp Consul 1.7.9 Hashicorp Consul 1.7.10 Hashicorp Consul 1.7.11 Hashicorp Consul 1.7.12 Hashicorp Consul 1.7.13 Hashicorp Consul 1.7.14 Hashicorp Consul 1.8.0 Hashicorp Consul 1.8.1 Hashicorp Consul 1.8.2 Hashicorp Consul 1.8.3 Hashicorp Consul 1.8.4 Hashicorp Consul 1.8.5 Hashicorp Consul 1.8.6 Hashicorp Consul 1.8.7 Hashicorp Consul 1.8.8 Hashicorp Consul 1.8.9 Hashicorp Consul 1.8.10 Hashicorp Consul 1.8.14	289

Common Weakness Enumeration (CWE)

CWE-129 - Improper Validation of Array Index

Common Attack Pattern Enumeration and Classification (CAPEC)

Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References