OSV-SCALIBR Filesystem Traversal Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in OSV-SCALIBR due to a bug in the filesystem traversal fallback path. When the ReadDir function returns nil for an empty directory, the diriterate.Next() method overindexes an empty slice, causing a panic from an index-out-of-range error and crashing the application. This issue arises in scenarios where a custom filesystem implementation does not support the fs.ReadDirFile interface, leading to the incorrect assumption that a nil response indicates the presence of files.

Impact

Exploitation of this vulnerability causes a panic from an index-out-of-range error, leading to an application crash.

Remediation

Users can update to OSV-SCALIBR version 0.4.0, which includes the necessary fix. Instructions for updating can be found in the OSV-SCALIBR repository on GitHub.