Snyk test report

Scanned the following paths:

docker.io/mongo:8.0/mongo (deb)
docker.io/mongo:8.0//usr/bin/bsondump (gomodules)
docker.io/mongo:8.0//usr/bin/mongodump (gomodules)
docker.io/mongo:8.0//usr/bin/mongoexport (gomodules)
docker.io/mongo:8.0//usr/bin/mongofiles (gomodules)
docker.io/mongo:8.0//usr/bin/mongoimport (gomodules)
docker.io/mongo:8.0//usr/bin/mongorestore (gomodules)
docker.io/mongo:8.0//usr/bin/mongostat (gomodules)
docker.io/mongo:8.0//usr/bin/mongotop (gomodules)
docker.io/mongo:8.0/tianon/gosu//usr/local/bin/gosu (gomodules)

1 known vulnerabilities

8 vulnerable dependency paths

1425 dependencies

Integer Overflow

high severity

Exploit: Not Defined

Manifest file: docker.io/mongo:8.0 › /usr/bin/bsondump
Package Manager: golang
Vulnerable module: github.com/klauspost/compress/s2
Introduced through: go-distribution@command-line-arguments@* and github.com/klauspost/compress/s2@v1.18.6

Detailed paths

Introduced through: go-distribution@command-line-arguments@* › github.com/klauspost/compress/s2@v1.18.6
Introduced through: go-distribution@command-line-arguments@* › github.com/klauspost/compress/s2@v1.18.6
Introduced through: go-distribution@command-line-arguments@* › github.com/klauspost/compress/s2@v1.18.6
Introduced through: go-distribution@command-line-arguments@* › github.com/klauspost/compress/s2@v1.18.6
Introduced through: go-distribution@command-line-arguments@* › github.com/klauspost/compress/s2@v1.18.6
Introduced through: go-distribution@command-line-arguments@* › github.com/klauspost/compress/s2@v1.18.6
Introduced through: go-distribution@command-line-arguments@* › github.com/klauspost/compress/s2@v1.18.6
Introduced through: go-distribution@command-line-arguments@* › github.com/klauspost/compress/s2@v1.18.6

Overview

Affected versions of this package are vulnerable to Integer Overflow leading to an out-of-bounds write in the s2.NewDict() function in s2/dict.go, which reads a uvarint and converts it to int without checking whether it exceeds MaxInt64. An attacker can crash the process with a segmentation fault by supplying S2 dictionary data whose repeat-index uvarint exceeds MaxInt64, which becomes a negative int that bypasses the index validation and drives out-of-bounds arithmetic through unsafe.Pointer in Dict.Encode(). Exploitation requires the application to build an S2 dictionary from attacker-controlled data with s2.NewDict() and then call Dict.Encode() on input of at least 32 bytes.

Remediation

Upgrade github.com/klauspost/compress/s2 to version 1.18.7 or higher.

References

More about this vulnerability