Detections
Analytics

SCA: security update for github.com/gagliardetto/binary (GHSA-4p6f-m4f9-ch88)

high Tenable Cloud Security Plugin ID 410303

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation
 vulnerability that can be exploited to allocate slices in memory with (arbitrary) excessive size value,
 which can either exhaust available memory or crash the whole program. When using
 `github.com/gagliardetto/binary` to parse unchecked (or wrong type of) data from untrusted sources of
 input (e.g. the blockchain) into slices, it's possible to allocate memory with excessive size. When
 `dec.Decode(&val)` method is used to parse data into a structure that is or contains slices of values, the
 length of the slice was previously read directly from the data itself without any checks on the size of
 it, and then a slice was allocated. This could lead to an overflow and an allocation of memory with
 excessive size value. Users should upgrade to `v0.7.1` or higher. A workaround is not to rely on the
 `dec.Decode(&val)` function to parse the data, but to use a custom `UnmarshalWithDecoder()` method that
 reads and checks the length of any slice. (CVE-2022-36078)

See Also

https://github.com/advisories/GHSA-4p6f-m4f9-ch88

Plugin Details

Severity: High

ID: 410303

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2022-36078

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/16/2022

Vulnerability Publication Date: 9/2/2022

Reference Information

CVE: CVE-2022-36078