GHSA-6v7p-g79w-8964

Summary

MessagePack for Python (the `msgpack` package) has an out-of-bounds read in versions up to and including 1.2.0. If an `Unpacker` is reused after it has raised and caught an error, it can read out of bounds and crash the process with a segmentation fault. Code that streams untrusted MessagePack through a single long-lived `Unpacker` can therefore be crashed on demand, a denial-of-service risk.

How to fix it

• Upgrade `msgpack` to 1.2.1 or later, which fixes the out-of-bounds read.
• Until you can upgrade, never reuse an `Unpacker` after it has raised an error: discard it and create a new one.
• Treat any stream that has already hit an unpacking error as untrustworthy and stop reading from it.

How to avoid it in your code

• Create a fresh deserializer per message (or at least per error) when parsing untrusted binary input; do not carry a stateful parser across an error boundary.
• Put size and resource limits around deserialization of untrusted data, and isolate it so a crash cannot take down a shared process.
• Keep serialization libraries patched and subscribe to advisories for any format you parse at a network boundary.

References

• https://github.com/advisories/GHSA-6v7p-g79w-8964
• https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964
• https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d
• https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1