-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Amazon.IonDotnet | nuget | < 1.3.1 | 1.3.1 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions that the RawBinaryReader class is affected and that an infinite loop can occur when reading binary Ion data if it's malformed or truncated. The provided commit 34a4f5215eceac1bb7bf434c4f2310d64d1b703b shows a modification in the Amazon.IonDotnet/Internals/Binary/RawBinaryReader.cs file, specifically within the ReadAll method. The patch introduces a check for amount == 0 inside a while (length > 0) loop. If this.input.Read returns 0 (indicating end-of-stream or no data read) while length is still positive, the original code would loop infinitely because length would not decrease. The added check throws an UnexpectedEofException, preventing the infinite loop. Therefore, the ReadAll method is the vulnerable function as it contained the logic susceptible to the infinite loop under specific input conditions.
C#C#Ongoing coverage of React2Shell