[GHSA-375g-39jq-vq7m] Potential buffer overflow in CBOR2 decoder

[Chi-Song-Owen]

Updates

• Affected products
• References

Comments
The current reference to commit 4de6991ba29bf2290d7b9d83525eda7d021873df appears unrelated to the long-string decoding vulnerability described in this advisory. That commit fixes error handling in CBORTag_hash() for recursive references, as reported in agronholm/cbor2#213. The corresponding fix for the advisory’s decoding issue is agronholm/cbor2@0423e46, which initializes consumed to chunk_length before calling PyUnicode_DecodeUTF8Stateful(). This works around python/cpython#99612, where ASCII-only input could leave consumed unset. Please replace the unrelated reference with this fix commit.

[github]

Hi there @agronholm! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory