CVE-2022-2879

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-2879
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://go.dev/cl/439355 Patch
https://go.dev/issue/54853 Issue Tracking Third Party Advisory
https://groups.google.com/g/golang-announce/c/xtuG5faxtaU Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2022-1037 Vendor Advisory
https://security.gentoo.org/glsa/202311-09
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
History

25 Nov 2023, 11:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202311-09 -

03 Mar 2023, 15:41

Type Values Removed Values Added
References (MISC) https://groups.google.com/g/golang-announce/c/xtuG5faxtaU - Mailing List, Third Party Advisory (MISC) https://groups.google.com/g/golang-announce/c/xtuG5faxtaU - Mailing List, Release Notes
References (MISC) https://go.dev/cl/439355 - Vendor Advisory (MISC) https://go.dev/cl/439355 - Patch
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

27 Dec 2022, 22:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THKJHFMX4DAZXJ5MFPN3BNHZDN7BW5RI/', 'name': 'FEDORA-2022-59a20edab2', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}

18 Oct 2022, 12:48

Type Values Removed Values Added
CWE CWE-770
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
First Time Fedoraproject
Golang
Golang go
Fedoraproject fedora
References (MISC) https://go.dev/issue/54853 - (MISC) https://go.dev/issue/54853 - Issue Tracking, Third Party Advisory
References (MISC) https://pkg.go.dev/vuln/GO-2022-1037 - (MISC) https://pkg.go.dev/vuln/GO-2022-1037 - Vendor Advisory
References (MISC) https://groups.google.com/g/golang-announce/c/xtuG5faxtaU - (MISC) https://groups.google.com/g/golang-announce/c/xtuG5faxtaU - Mailing List, Third Party Advisory
References (MISC) https://go.dev/cl/439355 - (MISC) https://go.dev/cl/439355 - Vendor Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THKJHFMX4DAZXJ5MFPN3BNHZDN7BW5RI/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THKJHFMX4DAZXJ5MFPN3BNHZDN7BW5RI/ - Mailing List, Third Party Advisory

18 Oct 2022, 01:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THKJHFMX4DAZXJ5MFPN3BNHZDN7BW5RI/ -

14 Oct 2022, 15:29

Type Values Removed Values Added
New CVE
Information

Published : 2022-10-14 15:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-2879

Mitre link : CVE-2022-2879

CVE.ORG link : CVE-2022-2879

JSON object : View

Products Affected

golang

  • go
CWE
CWE-770

Allocation of Resources Without Limits or Throttling