Amazon.IonDotnet RawBinaryReader Class Infinite Loop Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the Amazon.IonDotnet library, specifically in versions through 1.3.0. The issue arises in the RawBinaryReader class, where the library fails to validate the number of bytes read from the underlying stream during the deserialization of binary Ion data. This lack of validation can lead to an infinite loop condition, particularly when the Ion data is malformed or truncated, potentially causing a denial-of-service situation.

Impact

Exploitation of this vulnerability creates an infinite loop condition, which can lead to a denial-of-service scenario, causing the application to become unresponsive or unavailable.

Remediation

Users are advised to upgrade to Amazon.IonDotnet version 1.3.1. If any forked or derivative code is in use, it should be patched to incorporate the new fixes.