7.5 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files, ctx.diskToOriginal, and ctx.filesByField maps and slices. Go maps and slices are not safe for concurrent mutation, so a crafted multipart request containing many downloadFrom entries can trigger a data race and terminate the process with a fatal concurrent map writes runtime error. The default configuration enables downloadFrom and disables authentication, allowing an unauthenticated remote attacker to crash an exposed conversion service and cause a denial of service. This issue is fixed in version 8.33.0.
References
-
https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32 x_refsource_CONFIRMexploit
-
https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0 x_refsource_MISC
Affected products
- ==>= 8.10.0, < 8.33.0
Matching in nixpkgs
pkgs.gotenberg
Converts numerous document formats into PDF files
pkgs.python313Packages.gotenberg-client
Python client for interfacing with the Gotenberg API
Package maintainers
-
@MiniHarinn Harinn <prinn.dev@pm.me>
-
@leona-ya Leona Maroni <nix@leona.is>