Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-4741

CVE-2022-4741: docconv vulnerable to Memory Allocation with Excessive Size Value

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-4741
GHSA ID
GHSA-qvx2-59g8-8hph
EPSS Score
0.1733%
CWE
CWE-789
Published
12/25/2022
Updated
3/1/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/sajari/docconvgo< 1.2.11.2.1
code.sajari.com/docconvgo< 1.2.11.2.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from uncontrolled memory allocation when processing untrusted inputs. The commit 42bcff6 adds size limits to all these functions by wrapping readers with io.LimitReader. The affected functions are explicitly named in vulnerability descriptions and correspond to files modified in the patch. Each was using unbounded ReadAll/Decoder operations prior to the fix, making them clear vectors for memory exhaustion attacks.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in *o**onv up to *.*.* *n* *l*ssi*i** *s pro*l*m*ti*. T*is issu* *****ts t** *un*tion `*onv*rt*o*x/*onv*rtO*T/*onv*rtP***s/*onv*rtXML/XMLToT*xt`. T** m*nipul*tion l***s to un*ontroll** m*mory *llo**tion. T** *tt**k m*y ** in

Reasoning

T** vuln*r**ility st*ms *rom un*ontroll** m*mory *llo**tion w**n pro**ssin* untrust** inputs. T** *ommit ******* ***s siz* limits to *ll t**s* *un*tions *y wr*ppin* r****rs wit* `io.LimitR****r`. T** *****t** *un*tions *r* *xpli*itly n*m** in vuln*r*