GHSA-f786-75f3-74xj
OSV-SCALIBR has NULL Pointer Dereference
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2025-13425
- Alias
- GO-2025-4149
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P
Description
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · github.com/google/osv-scalibr | introduced 0, fixed 0.3.4 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2025-13425 ADVISORY
- https://github.com/google/osv-scalibr/commit/e67c4e198ca099cb7c16957a80f6c5331d90a672 WEB
- https://github.com/advisories/GHSA-f786-75f3-74xj ADVISORY
- https://github.com/google/osv-scalibr PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |