x/vulndb: potential Go vuln in google.golang.org/protobuf/internal/encoding/json: GHSA-8r3f-844c-mc37

[GoVulnBot]

In GitHub Security Advisory GHSA-8r3f-844c-mc37, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
google.golang.org/protobuf/internal/encoding/json	1.33.0	< 1.33.0

Cross references:

• CVE-2024-24786 appears in issue x/vulndb: potential Go vuln in google.golang.org/protobuf: CVE-2024-24786 #2611

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: google.golang.org/protobuf/internal/encoding/json
      versions:
        - fixed: 1.33.0
      packages:
        - package: google.golang.org/protobuf/internal/encoding/json
    - module: google.golang.org/protobuf/internal/encoding/json
      versions:
        - fixed: 1.33.0
      packages:
        - package: google.golang.org/protobuf/encoding/protojson
    - module: google.golang.org/protobuf/internal/encoding/json
      versions:
        - fixed: 1.33.0
      packages:
        - package: google.golang.org/protobuf
summary: |-
    Golang protojson.Unmarshal function infinite loop when unmarshaling certain
    forms of invalid JSON
cves:
    - CVE-2024-24786
ghsas:
    - GHSA-8r3f-844c-mc37
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2024-24786
    - fix: https://go.dev/cl/569356
    - web: https://pkg.go.dev/vuln/GO-2024-2611
    - fix: https://github.com/protocolbuffers/protobuf-go/commit/f01a588e5810b90996452eec4a28f22a0afae023
    - web: https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.33.0
    - advisory: https://github.com/advisories/GHSA-8r3f-844c-mc37

[gopherbot]

Change https://go.dev/cl/576677 mentions this issue: data/reports: add GHSA for GO-2024-2611