CVE-2022-30631 - OpenCVE

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Golang	Go

Configuration 1 [-]

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

References

Link	Resource
https://go.dev/cl/417067	Patch Vendor Advisory
https://go.dev/issue/53168	Issue Tracking Vendor Advisory
https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e	Mailing List Patch Vendor Advisory
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE	Mailing List Vendor Advisory
https://pkg.go.dev/vuln/GO-2022-0524	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: Go

Published: 2022-08-09T20:16:32

Updated: 2023-06-12T19:04:40.977Z

Reserved: 2022-05-12T00:00:00

Link: CVE-2022-30631

JSON object: View

NVD Information

Status : Modified

Published: 2022-08-10T20:15:41.373

Modified: 2023-11-07T03:47:16.597

Link: CVE-2022-30631

JSON object: View

Redhat Information

No data.

CWE

CWE-674

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "646881F6-A299-4D92-A1F3-E95959FA426F", "versionEndExcluding": "1.17.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE088A2D-7894-4A48-887C-36DD727A7BEB", "versionEndExcluding": "1.18.4", "versionStartIncluding": "1.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files."}, {"lang": "es", "value": "Una recursi\u00f3n no controlada en el archivo Reader.Read en compress/gzip versiones anteriores a Go 1.17.12 y Go 1.18.4, permite a un atacante causar un p\u00e1nico debido al agotamiento de la pila por medio de un archivo que contenga un gran n\u00famero de archivos comprimidos de longitud 0 concatenados"}], "id": "CVE-2022-30631", "lastModified": "2023-11-07T03:47:16.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-10T20:15:41.373", "references": [{"source": "security@golang.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://go.dev/cl/417067"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/issue/53168"}, {"source": "security@golang.org", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "url": "https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e"}, {"source": "security@golang.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"}, {"source": "security@golang.org", "tags": ["Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2022-0524"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "nvd@nist.gov", "type": "Primary"}]}