{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2014-125026", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2022-07-29T16:08:15.703Z", "datePublished": "2022-12-27T21:13:06.589Z", "dateUpdated": "2024-08-06T14:10:56.370Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-06-12T19:03:26.399Z"}, "title": "Out-of-bounds write in github.com/cloudflare/golz4", "descriptions": [{"lang": "en", "value": "LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input."}], "affected": [{"vendor": "github.com/cloudflare/golz4", "product": "github.com/cloudflare/golz4", "collectionURL": "https://pkg.go.dev", "packageName": "github.com/cloudflare/golz4", "versions": [{"version": "0", "lessThan": "0.0.0-20140711154735-199f5f787806", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "Uncompress"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE 94: Improper Control of Generation of Code ('Code Injection')"}]}], "references": [{"url": "https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898"}, {"url": "https://github.com/cloudflare/golz4/issues/5"}, {"url": "https://pkg.go.dev/vuln/GO-2020-0022"}], "credits": [{"lang": "en", "value": "Yann Collet"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T14:10:56.370Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898", "tags": ["x_transferred"]}, {"url": "https://github.com/cloudflare/golz4/issues/5", "tags": ["x_transferred"]}, {"url": "https://pkg.go.dev/vuln/GO-2020-0022", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudflare:golz4:*:*:*:*:*:go:*:*", "matchCriteriaId": "CF7258F9-47C1-4E63-A1FD-5BB5378558BA", "versionEndExcluding": "2014-07-11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input."}, {"lang": "es", "value": "Los enlaces LZ4 utilizan una API C obsoleta que es vulnerable a la corrupci\u00f3n de la memoria, lo que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario si se llama con entradas de usuarios que no son de confianza."}], "id": "CVE-2014-125026", "lastModified": "2023-01-06T15:24:30.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-27T22:15:10.883", "references": [{"source": "security@golang.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/cloudflare/golz4/issues/5"}, {"source": "security@golang.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2020-0022"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "golz4: memory corruption vulnerability in golz4", "id": "2156869", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156869"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-400", "details": ["LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.", "A flaw was found in the golz4 package. LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input."], "name": "CVE-2014-125026", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "moderate", "package_name": "openshift4/ose-baremetal-installer-rhel7", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "moderate", "package_name": "openshift4/ose-installer", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "moderate", "package_name": "openshift4/ose-installer-artifacts", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2022-12-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-125026\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-125026"], "statement": "The golz4 is a transitive dependency in OpenShift. Hence, the impact for Red Hat OpenShift Container Platform 4 is lowered to moderate.", "threat_severity": "Critical"}