Skip to content
Fencer Intel
high 7.5

GHSA-wxwq-525w-hcqx json

Yapscan Denial of Service vulnerability in report server

published 3y ago modified 8mo ago also GO-2023-1607

cvss
7.5
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

If you use the report server, it may be vulnerable to a Denial of Service attack.

### Patches

Has been patched in v0.19.2.

### References

The vulnerability was inherited by the following upstream vulnerabilites

- [golang.org/x/text < v0.3.7](https://github.com/advisories/GHSA-ppp9-7jff-5vj2) - [golang.org/x/net < 0.0.0-20220906165146-f3363e06e74c](https://github.com/advisories/GHSA-69cg-p879-7622)

Patch / fix

  • go github.com/fkie-cad/yapscan 0.19.2

Is GHSA-wxwq-525w-hcqx in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/fkie-cad/yapscan
>=0.18.0, <0.19.2
0.19.2

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.