Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

[ Description ]Official description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.

[ Fixes ]Fixes and patches

• github.com/tomwright/dasel/v3 3.11.1Fixed version · GitHub Advisories · go package github.com/tomwright/dasel/v3: upgrade to 3.11.1 or later (affected >= 3.0.0, <= 3.11.0)

[ Packages ]Affected open-source packages

• github.com/tomwright/dasel/v3 goAffected >= 3.0.0, <= 3.11.0 · fixed in 3.11.1 · GHSA-cqxr-jxr2-85pq

[ References ]References

• github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pqx_refsource_CONFIRM
• github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68x_refsource_MISC
• github.com/TomWright/dasel/releases/tag/v3.11.1x_refsource_MISC