Impact
When storing metadata in encrypted INI or DotEnv files, SOPS flattens metadata. Since metadata can contain lists, the unflattening code makes sure that lists are resized appropriately to be able to contain an index extracted from a metadata key. For example, if a element with key a__list_20000000 is found, SOPS makes sure that the list stored under key a has at least 20000001 elements.
By crafting a simple INI or DotEnv file that contains an extremely large list index in the metadata, SOPS can be tricked into allocating a huge amount of memory. This can be used for Denial of Service attacks, in particular if SOPS is embedded in another application.
Patches and mitigations
SOPS 3.13.0 contains a rewrite of the unflattening code that collects all metadata keys in a tree structure before attempting to allocate a list. If a set of list of non-consecutive list indices is found, our a list not starting at 1, SOPS will abort unflattening the metadata and not allocate a list to accomodate these list indices.
For SOPS < 3.13.0, users should avoid to decrypt untrusted INI and DotEnv files.
References
For more information
If you have any questions or comments about this advisory:
bugbunny-research Reporter
Impact
When storing metadata in encrypted INI or DotEnv files, SOPS flattens metadata. Since metadata can contain lists, the unflattening code makes sure that lists are resized appropriately to be able to contain an index extracted from a metadata key. For example, if a element with key
a__list_20000000is found, SOPS makes sure that the list stored under keyahas at least 20000001 elements.By crafting a simple INI or DotEnv file that contains an extremely large list index in the metadata, SOPS can be tricked into allocating a huge amount of memory. This can be used for Denial of Service attacks, in particular if SOPS is embedded in another application.
Patches and mitigations
SOPS 3.13.0 contains a rewrite of the unflattening code that collects all metadata keys in a tree structure before attempting to allocate a list. If a set of list of non-consecutive list indices is found, our a list not starting at 1, SOPS will abort unflattening the metadata and not allocate a list to accomodate these list indices.
For SOPS < 3.13.0, users should avoid to decrypt untrusted INI and DotEnv files.
References
For more information
If you have any questions or comments about this advisory: