Use of Weak Hash Affecting messagepack package, versions [,2.5.187)[2.6.95-alpha,3.0.214-rc.1)

MessagePack is a MessagePack(MsgPack) Serializer for C#(.NET, .NET Core, Unity, Xamarin).

Affected versions of this package are vulnerable to Use of Weak Hash through the deserialization process. An attacker can cause a denial of service by sending specially crafted data that leads to hash collisions or stack overflow.

Notes:

1. This vulnerability is caused by an incomplete fix for CVE-2020-5234.

2. When deserializing untrusted data, it is recommend to put MessagePack into a more secure mode with:

MessagePackSecurity.Active = MessagePackSecurity.UntrustedData;

1. Declare a class that derives from MessagePackSecurity.

2. Override the GetHashCollisionResistantEqualityComparer<T> method to provide a collision-resistant hash function of your own and avoid calling base.GetHashCollisionResistantEqualityComparer<T>().

3. Configure a MessagePackSerializerOptions with an instance of your derived type by calling WithSecurity on an existing options object.

4. Use your custom options object for all deserialization operations. This may be by setting the MessagePackSerializer.DefaultOptions static property, if you call methods that rely on this default property, and/or by passing in the options object explicitly to any Deserialize method.

• GitHub Commit
• GitHub Commit