MinatoWu opened a new issue, #2899:
URL: https://github.com/apache/dubbo-go/issues/2899
### Environment
### Issue description
<!-- Here is a brief description about the issue. -->
### Logs
<details><summary>Click me to check logs</summary>
```
Copy logs to here.
```
=== Symbol Results ===
Vulnerability #1: GO-2024-2611
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
More info: https://pkg.go.dev/vuln/GO-2024-2611
Module: google.golang.org/protobuf
Found in: google.golang.org/[email protected]
Fixed in: google.golang.org/[email protected]
Example traces found:
#1: protocol/triple/triple_protocol/codec.go:168:26:
triple_protocol.protoJSONCodec.Unmarshal calls
protojson.UnmarshalOptions.Unmarshal, which eventually calls json.Decoder.Peek
#2: protocol/triple/triple_protocol/codec.go:168:26:
triple_protocol.protoJSONCodec.Unmarshal calls
protojson.UnmarshalOptions.Unmarshal, which eventually calls json.Decoder.Read
#3: filter/generic/generalizer/protobuf_json.go:81:28:
generalizer.ProtobufJsonGeneralizer.Realize calls protojson.Unmarshal
#4: protocol/triple/triple_protocol/codec.go:168:26:
triple_protocol.protoJSONCodec.Unmarshal calls
protojson.UnmarshalOptions.Unmarshal
Vulnerability #2: GO-2023-2153
Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc
More info: https://pkg.go.dev/vuln/GO-2023-2153
Module: google.golang.org/grpc
Found in: google.golang.org/[email protected]
Fixed in: google.golang.org/[email protected]
Example traces found:
#1: protocol/grpc/internal/routeguide/server.go:159:26:
routeguide.NewServer calls grpc.NewServer
#2: protocol/grpc/internal/routeguide/server.go:174:26:
routeguide.Server.Start calls grpc.Server.Serve
#3: protocol/grpc/internal/routeguide/server.go:174:26:
routeguide.Server.Start calls grpc.Server.Serve, which eventually calls
transport.NewServerTransport
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
