cbor2 CBORDecoder Shareable Value Leakage Vulnerability

A vulnerability exists in the cbor2 library, specifically in versions 3.0.0 prior to 5.8.0, within the CBORDecoder component. When a CBORDecoder instance is reused for multiple decoding operations, values tagged as shareable (tag 28) can persist in memory. This allows an attacker to access these values through subsequent messages using the sharedref tag (29), potentially reading data from previously decoded messages if the decoder is used across different trust boundaries.

Impact

This vulnerability can lead to unauthorized information disclosure, allowing an attacker to access sensitive data from previously decoded messages.

Reproduction

To reproduce this vulnerability, first encode a CBOR message from a trusted source that includes a shareable value. Then, send an attacker-controlled message that references this shareable value using the sharedref tag. The CBORDecoder must be reused across trust boundaries for the attack to succeed.

Remediation

Users should update to cbor2 version 5.8.0 or later, where this vulnerability has been patched.