Vulnerability-Lookup

RHSA-2024_2180

Vulnerability from csaf_redhat - Published: 2024-04-30 10:27 - Updated: 2024-12-17 22:40

Summary

Red Hat Security Advisory: runc security update

Severity

Moderate

Notes

Topic: An update for runc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. Security Fix(es): * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-30630

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:2180

CVE-2022-30631

A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2023-45287

A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the environment.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-208 - Observable Timing Discrepancy

Workaround No current mitigation is available for this vulnerability.

References

URL

Category

	https://access.redhat.com/errata/RHSA-2024:2180	self
	https://access.redhat.com/security/updates/classi…	external
	https://access.redhat.com/documentation/en-us/red…	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107342	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107371	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107386	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2253193	external
	https://issues.redhat.com/browse/RHEL-25116	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2022-30630	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107371	external
	https://www.cve.org/CVERecord?id=CVE-2022-30630	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30630	external
	https://go.dev/issue/53415	external
	https://groups.google.com/g/golang-announce/c/nqr…	external
	https://access.redhat.com/security/cve/CVE-2022-30631	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107342	external
	https://www.cve.org/CVERecord?id=CVE-2022-30631	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30631	external
	https://go.dev/issue/53168	external
	https://access.redhat.com/security/cve/CVE-2022-30632	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107386	external
	https://www.cve.org/CVERecord?id=CVE-2022-30632	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30632	external
	https://go.dev/issue/53416	external
	https://access.redhat.com/security/cve/CVE-2023-45287	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2253193	external
	https://www.cve.org/CVERecord?id=CVE-2023-45287	external
	https://nvd.nist.gov/vuln/detail/CVE-2023-45287	external
	https://pkg.go.dev/vuln/GO-2023-2375	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for runc is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.\n\nSecurity Fix(es):\n\n* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)\n\n* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)\n\n* golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)\n\n* golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:2180",
        "url": "https://access.redhat.com/errata/RHSA-2024:2180"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2107342",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107342"
      },
      {
        "category": "external",
        "summary": "2107371",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107371"
      },
      {
        "category": "external",
        "summary": "2107386",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107386"
      },
      {
        "category": "external",
        "summary": "2253193",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253193"
      },
      {
        "category": "external",
        "summary": "RHEL-25116",
        "url": "https://issues.redhat.com/browse/RHEL-25116"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2180.json"
      }
    ],
    "title": "Red Hat Security Advisory: runc security update",
    "tracking": {
      "current_release_date": "2024-12-17T22:40:46+00:00",
      "generator": {
        "date": "2024-12-17T22:40:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2024:2180",
      "initial_release_date": "2024-04-30T10:27:41+00:00",
      "revision_history": [
        {
          "date": "2024-04-30T10:27:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-04-30T10:27:41+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-17T22:40:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.4.0.GA",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.1.12-2.el9.src",
                "product": {
                  "name": "runc-4:1.1.12-2.el9.src",
                  "product_id": "runc-4:1.1.12-2.el9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc@1.1.12-2.el9?arch=src\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.1.12-2.el9.aarch64",
                "product": {
                  "name": "runc-4:1.1.12-2.el9.aarch64",
                  "product_id": "runc-4:1.1.12-2.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc@1.1.12-2.el9?arch=aarch64\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-debugsource-4:1.1.12-2.el9.aarch64",
                "product": {
                  "name": "runc-debugsource-4:1.1.12-2.el9.aarch64",
                  "product_id": "runc-debugsource-4:1.1.12-2.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc-debugsource@1.1.12-2.el9?arch=aarch64\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-debuginfo-4:1.1.12-2.el9.aarch64",
                "product": {
                  "name": "runc-debuginfo-4:1.1.12-2.el9.aarch64",
                  "product_id": "runc-debuginfo-4:1.1.12-2.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc-debuginfo@1.1.12-2.el9?arch=aarch64\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.1.12-2.el9.ppc64le",
                "product": {
                  "name": "runc-4:1.1.12-2.el9.ppc64le",
                  "product_id": "runc-4:1.1.12-2.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc@1.1.12-2.el9?arch=ppc64le\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-debugsource-4:1.1.12-2.el9.ppc64le",
                "product": {
                  "name": "runc-debugsource-4:1.1.12-2.el9.ppc64le",
                  "product_id": "runc-debugsource-4:1.1.12-2.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc-debugsource@1.1.12-2.el9?arch=ppc64le\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-debuginfo-4:1.1.12-2.el9.ppc64le",
                "product": {
                  "name": "runc-debuginfo-4:1.1.12-2.el9.ppc64le",
                  "product_id": "runc-debuginfo-4:1.1.12-2.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc-debuginfo@1.1.12-2.el9?arch=ppc64le\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.1.12-2.el9.x86_64",
                "product": {
                  "name": "runc-4:1.1.12-2.el9.x86_64",
                  "product_id": "runc-4:1.1.12-2.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc@1.1.12-2.el9?arch=x86_64\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-debugsource-4:1.1.12-2.el9.x86_64",
                "product": {
                  "name": "runc-debugsource-4:1.1.12-2.el9.x86_64",
                  "product_id": "runc-debugsource-4:1.1.12-2.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc-debugsource@1.1.12-2.el9?arch=x86_64\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-debuginfo-4:1.1.12-2.el9.x86_64",
                "product": {
                  "name": "runc-debuginfo-4:1.1.12-2.el9.x86_64",
                  "product_id": "runc-debuginfo-4:1.1.12-2.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc-debuginfo@1.1.12-2.el9?arch=x86_64\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.1.12-2.el9.s390x",
                "product": {
                  "name": "runc-4:1.1.12-2.el9.s390x",
                  "product_id": "runc-4:1.1.12-2.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc@1.1.12-2.el9?arch=s390x\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-debugsource-4:1.1.12-2.el9.s390x",
                "product": {
                  "name": "runc-debugsource-4:1.1.12-2.el9.s390x",
                  "product_id": "runc-debugsource-4:1.1.12-2.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc-debugsource@1.1.12-2.el9?arch=s390x\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-debuginfo-4:1.1.12-2.el9.s390x",
                "product": {
                  "name": "runc-debuginfo-4:1.1.12-2.el9.s390x",
                  "product_id": "runc-debuginfo-4:1.1.12-2.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/runc-debuginfo@1.1.12-2.el9?arch=s390x\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.1.12-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64"
        },
        "product_reference": "runc-4:1.1.12-2.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.1.12-2.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le"
        },
        "product_reference": "runc-4:1.1.12-2.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.1.12-2.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x"
        },
        "product_reference": "runc-4:1.1.12-2.el9.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.1.12-2.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src"
        },
        "product_reference": "runc-4:1.1.12-2.el9.src",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.1.12-2.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64"
        },
        "product_reference": "runc-4:1.1.12-2.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-debuginfo-4:1.1.12-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64"
        },
        "product_reference": "runc-debuginfo-4:1.1.12-2.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-debuginfo-4:1.1.12-2.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le"
        },
        "product_reference": "runc-debuginfo-4:1.1.12-2.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-debuginfo-4:1.1.12-2.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x"
        },
        "product_reference": "runc-debuginfo-4:1.1.12-2.el9.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-debuginfo-4:1.1.12-2.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64"
        },
        "product_reference": "runc-debuginfo-4:1.1.12-2.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-debugsource-4:1.1.12-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64"
        },
        "product_reference": "runc-debugsource-4:1.1.12-2.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-debugsource-4:1.1.12-2.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le"
        },
        "product_reference": "runc-debugsource-4:1.1.12-2.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-debugsource-4:1.1.12-2.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x"
        },
        "product_reference": "runc-debugsource-4:1.1.12-2.el9.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-debugsource-4:1.1.12-2.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
        },
        "product_reference": "runc-debugsource-4:1.1.12-2.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.GA"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-30630",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107371"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: io/fs: stack exhaustion in Glob",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107371",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107371"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30630",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30630",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53415",
          "url": "https://go.dev/issue/53415"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-30T10:27:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:2180"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: io/fs: stack exhaustion in Glob"
    },
    {
      "cve": "CVE-2022-30631",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: compress/gzip: stack exhaustion in Reader.Read",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30631",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53168",
          "url": "https://go.dev/issue/53168"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-30T10:27:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:2180"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: compress/gzip: stack exhaustion in Reader.Read"
    },
    {
      "cve": "CVE-2022-30632",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107386"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: path/filepath: stack exhaustion in Glob",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30632"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107386",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107386"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30632",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30632"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30632",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30632"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53416",
          "url": "https://go.dev/issue/53416"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-30T10:27:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:2180"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: path/filepath: stack exhaustion in Glob"
    },
    {
      "cve": "CVE-2023-45287",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "discovery_date": "2023-12-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2253193"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The identified flaw in the Golang crypto/tls library, is assessed as a moderate severity issue rather than important due to several mitigating factors. Although the vulnerability exposes a Timing Side Channel, potentially allowing information retrieval through RSA-based TLS key exchanges, its exploitation demands significant access and expertise. Additionally, while earlier versions implemented RSA blinding to counter timing attacks, the removal of PKCS#1 padding may still leak timing data. However, the practicality of exploiting this flaw is limited, and the transition to a fully constant time RSA implementation in Go 1.20 significantly bolsters security, reducing the risk posed by timing side channels.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
          "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
          "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-45287"
        },
        {
          "category": "external",
          "summary": "RHBZ#2253193",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253193"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-45287",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45287"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45287",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45287"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2023-2375",
          "url": "https://pkg.go.dev/vuln/GO-2023-2375"
        }
      ],
      "release_date": "2023-12-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-30T10:27:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:2180"
        },
        {
          "category": "workaround",
          "details": "No current mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.src",
            "AppStream-9.4.0.GA:runc-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debuginfo-4:1.1.12-2.el9.x86_64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.aarch64",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.ppc64le",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.s390x",
            "AppStream-9.4.0.GA:runc-debugsource-4:1.1.12-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges."
    }
  ]
}

CVE-2023-45287 (GCVE-0-2023-45287)

Vulnerability from cvelistv5 – Published: 2023-12-05 16:18 – Updated: 2025-02-13 17:14

Title

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

Summary

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.

Severity ?

No CVSS data available.

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

References

URL

Tags

	https://go.dev/issue/20654
	https://go.dev/cl/326012/26
	https://groups.google.com/g/golang-announce/c/QMK…
	https://people.redhat.com/~hkario/marvin/
	https://pkg.go.dev/vuln/GO-2023-2375
	https://security.netapp.com/advisory/ntap-2024011…

Impacted products

	Vendor	Product	Version
	Go standard library	crypto/tls	Affected: 0 , < 1.20.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/20654"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/326012/26"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/QMK8IQALDvA"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://people.redhat.com/~hkario/marvin/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-2375"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240112-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "rsaKeyAgreement.processClientKeyExchange"
            },
            {
              "name": "rsaKeyAgreement.generateClientKeyExchange"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.20.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T14:06:27.569Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/20654"
        },
        {
          "url": "https://go.dev/cl/326012/26"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/QMK8IQALDvA"
        },
        {
          "url": "https://people.redhat.com/~hkario/marvin/"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-2375"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240112-0005/"
        }
      ],
      "title": "Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-45287",
    "datePublished": "2023-12-05T16:18:06.104Z",
    "dateReserved": "2023-10-06T17:06:26.221Z",
    "dateUpdated": "2025-02-13T17:14:00.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30630 (GCVE-0-2022-30630)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:17 – Updated: 2026-03-06 17:48

Title

Stack exhaustion in Glob on certain paths in io/fs

Summary

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417065
	https://go.googlesource.com/go/+/fa2d41d0ca736f3a…
	https://go.dev/issue/53415
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0527

Impacted products

	Vendor	Product	Version
	Go standard library	io/fs	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:12.871Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417065"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53415"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0527"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-30630",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-24T20:38:26.312251Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T17:48:19.834Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "io/fs",
          "product": "io/fs",
          "programRoutines": [
            {
              "name": "Glob"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:48.349Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417065"
        },
        {
          "url": "https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59"
        },
        {
          "url": "https://go.dev/issue/53415"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0527"
        }
      ],
      "title": "Stack exhaustion in Glob on certain paths in io/fs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30630",
    "datePublished": "2022-08-09T20:17:15.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2026-03-06T17:48:19.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-30631 (GCVE-0-2022-30631)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:16 – Updated: 2025-10-20 17:51

Title

Stack exhaustion when reading certain archives in compress/gzip

Summary

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417067
	https://go.googlesource.com/go/+/b2b8872c876201ea…
	https://go.dev/issue/53168
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0524

Impacted products

	Vendor	Product	Version
	Go standard library	compress/gzip	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.231Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417067"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53168"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0524"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-30631",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-20T17:51:07.776953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-20T17:51:28.366Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "compress/gzip",
          "product": "compress/gzip",
          "programRoutines": [
            {
              "name": "Reader.Read"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:40.977Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417067"
        },
        {
          "url": "https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e"
        },
        {
          "url": "https://go.dev/issue/53168"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0524"
        }
      ],
      "title": "Stack exhaustion when reading certain archives in compress/gzip"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30631",
    "datePublished": "2022-08-09T20:16:32.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2025-10-20T17:51:28.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30632 (GCVE-0-2022-30632)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:15 – Updated: 2024-08-03 06:56

Title

Stack exhaustion on crafted paths in path/filepath

Summary

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Severity ?

No CVSS data available.

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417066
	https://go.googlesource.com/go/+/ac68c6c683409f98…
	https://go.dev/issue/53416
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0522

Impacted products

	Vendor	Product	Version
	Go standard library	path/filepath	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Credits

Juho Nurminen of Mattermost

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.251Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417066"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53416"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0522"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "path/filepath",
          "product": "path/filepath",
          "programRoutines": [
            {
              "name": "Glob"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Nurminen of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:36.688Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417066"
        },
        {
          "url": "https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef"
        },
        {
          "url": "https://go.dev/issue/53416"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0522"
        }
      ],
      "title": "Stack exhaustion on crafted paths in path/filepath"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30632",
    "datePublished": "2022-08-09T20:15:37.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T06:56:13.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2024_2180

CVE-2023-45287 (GCVE-0-2023-45287)

CVE-2022-30630 (GCVE-0-2022-30630)

CVE-2022-30631 (GCVE-0-2022-30631)

CVE-2022-30632 (GCVE-0-2022-30632)

Tags

Sightings

Nomenclature