CVE-2020-5234: Out-of-bounds Write (CWE-787)
value: MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2020-01-31T18:15Z
Repository: https://github.com/neuecc/MessagePack-CSharp
Language: Other
Files changed: src/MessagePack/PublicAPI.Unshipped.txt
Commit date: 2020-01-30 16:32:36 -0700
Commit message: Merge security fixes in for v2.1

Diff: diff --cc src/MessagePack/PublicAPI.Unshipped.txt
index 3c48191,130399c..7b92edf
--- a/src/MessagePack/PublicAPI.Unshipped.txt
+++ b/src/MessagePack/PublicAPI.Unshipped.txt
@@@ -1,14 -1,26 +1,32 @@@
  ﻿MessagePack.ExtensionHeader.Equals(MessagePack.ExtensionHeader other) -> bool
 +MessagePack.Formatters.InterfaceCollectionFormatter2<T>
 +MessagePack.Formatters.InterfaceCollectionFormatter2<T>.InterfaceCollectionFormatter2() -> void
 +MessagePack.Formatters.InterfaceListFormatter2<T>
 +MessagePack.Formatters.InterfaceListFormatter2<T>.InterfaceListFormatter2() -> void
+ MessagePack.MessagePackReader.Depth.get -> int
+ MessagePack.MessagePackReader.Depth.set -> void
  MessagePack.MessagePackReader.ReadDateTime(MessagePack.ExtensionHeader header) -> System.DateTime
  MessagePack.MessagePackReader.TryReadArrayHeader(out int count) -> bool
  MessagePack.MessagePackReader.TryReadExtensionFormatHeader(out MessagePack.ExtensionHeader extensionHeader) -> bool
  MessagePack.MessagePackReader.TryReadMapHeader(out int count) -> bool
+ MessagePack.MessagePackSecurity
+ MessagePack.MessagePackSecurity.DepthStep(ref MessagePack.MessagePackReader reader) -> void
+ MessagePack.MessagePackSecurity.GetEqualityComparer() -> System.Collections.IEqualityComparer
+ MessagePack.MessagePackSecurity.GetEqualityComparer<T>() -> System.Collections.Generic.IEqualityComparer<T>
+ MessagePack.MessagePackSecurity.HashCollisionResistant.get -> bool
+ MessagePack.MessagePackSecurity.MaximumObjectGraphDepth.get -> int
+ MessagePack.MessagePackSecurity.MessagePackSecurity(MessagePack.MessagePackSecurity copyFrom) -> void
+ MessagePack.MessagePackSecurity.WithHashCollisionResistant(bool hashCollisionResistant) -> MessagePack.MessagePackSecurity
+ MessagePack.MessagePackSecurity.WithMaximumObjectGraphDepth(int maximumObjectGraphDepth) -> MessagePack.MessagePackSecurity
+ MessagePack.MessagePackSerializerOptions.Security.get -> MessagePack.MessagePackSecurity
+ MessagePack.MessagePackSerializerOptions.WithSecurity(MessagePack.MessagePackSecurity security) -> MessagePack.MessagePackSerializerOptions
 +MessagePack.MessagePackStreamReader.DiscardBufferedData() -> void
 +MessagePack.MessagePackStreamReader.MessagePackStreamReader(System.IO.Stream stream, bool leaveOpen) -> void
  MessagePack.MessagePackStreamReader.ReadArrayAsync(System.Threading.CancellationToken cancellationToken) -> System.Collections.Generic.IAsyncEnumerable<System.Buffers.ReadOnlySequence<byte>>
  MessagePack.MessagePackWriter.WriteBinHeader(int length) -> void
- MessagePack.MessagePackWriter.WriteStringHeader(int byteCount) -> void
+ MessagePack.MessagePackWriter.WriteStringHeader(int byteCount) -> void
+ static readonly MessagePack.MessagePackSecurity.TrustedData -> MessagePack.MessagePackSecurity
+ static readonly MessagePack.MessagePackSecurity.UntrustedData -> MessagePack.MessagePackSecurity
+ virtual MessagePack.MessagePackSecurity.Clone() -> MessagePack.MessagePackSecurity
+ virtual MessagePack.MessagePackSecurity.GetHashCollisionResistantEqualityComparer() -> System.Collections.IEqualityComparer
+ virtual MessagePack.MessagePackSecurity.GetHashCollisionResistantEqualityComparer<T>() -> System.Collections.Generic.IEqualityComparer<T>

Vulnerable code:  MessagePack.MessagePackWriter.WriteStringHeader(int byteCount) -> void
Fixed code:  MessagePack.MessagePackReader.Depth.get -> int
 MessagePack.MessagePackReader.Depth.set -> void
 MessagePack.MessagePackSecurity
 MessagePack.MessagePackSecurity.DepthStep(ref MessagePack.MessagePackReader reader) -> void
 MessagePack.MessagePackSecurity.GetEqualityComparer() -> System.Collections.IEqualityComparer
 MessagePack.MessagePackSecurity.GetEqualityComparer<T>() -> System.Collections.Generic.IEqualityComparer<T>
 MessagePack.MessagePackSecurity.HashCollisionResistant.get -> bool
 MessagePack.MessagePackSecurity.MaximumObjectGraphDepth.get -> int
 MessagePack.MessagePackSecurity.MessagePackSecurity(MessagePack.MessagePackSecurity copyFrom) -> void
 MessagePack.MessagePackSecurity.WithHashCollisionResistant(bool hashCollisionResistant) -> MessagePack.MessagePackSecurity
 MessagePack.MessagePackSecurity.WithMaximumObjectGraphDepth(int maximumObjectGraphDepth) -> MessagePack.MessagePackSecurity
 MessagePack.MessagePackSerializerOptions.Security.get -> MessagePack.MessagePackSecurity
 MessagePack.MessagePackSerializerOptions.WithSecurity(MessagePack.MessagePackSecurity security) -> MessagePack.MessagePackSerializerOptions
 MessagePack.MessagePackWriter.WriteStringHeader(int byteCount) -> void
 static readonly MessagePack.MessagePackSecurity.TrustedData -> MessagePack.MessagePackSecurity
 static readonly MessagePack.MessagePackSecurity.UntrustedData -> MessagePack.MessagePackSecurity
 virtual MessagePack.MessagePackSecurity.Clone() -> MessagePack.MessagePackSecurity
 virtual MessagePack.MessagePackSecurity.GetHashCollisionResistantEqualityComparer() -> System.Collections.IEqualityComparer
 virtual MessagePack.MessagePackSecurity.GetHashCollisionResistantEqualityComparer<T>() -> System.Collections.Generic.IEqualityComparer<T>