{"containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-06-12T19:04:39.511Z"}, "title": "Stack exhaustion when unmarshaling certain documents in encoding/xml", "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag."}], "affected": [{"vendor": "Go standard library", "product": "encoding/xml", "collectionURL": "https://pkg.go.dev", "packageName": "encoding/xml", "versions": [{"version": "0", "lessThan": "1.17.12", "status": "affected", "versionType": "semver"}, {"version": "1.18.0-0", "lessThan": "1.18.4", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "Decoder.DecodeElement"}, {"name": "Decoder.unmarshal"}, {"name": "Decoder.unmarshalPath"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-674: Uncontrolled Recursion"}]}], "references": [{"url": "https://go.dev/cl/417061"}, {"url": "https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08"}, {"url": "https://go.dev/issue/53611"}, {"url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"}, {"url": "https://pkg.go.dev/vuln/GO-2022-0523"}]}}, "cveMetadata": {"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "assignerShortName": "Go", "cveId": "CVE-2022-30633", "datePublished": "2022-08-09T20:16:19", "dateReserved": "2022-05-12T00:00:00", "dateUpdated": "2023-06-12T19:04:39.511Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "646881F6-A299-4D92-A1F3-E95959FA426F", "versionEndExcluding": "1.17.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE088A2D-7894-4A48-887C-36DD727A7BEB", "versionEndExcluding": "1.18.4", "versionStartIncluding": "1.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag."}, {"lang": "es", "value": "Una recursi\u00f3n no controlada en Unmarshal en encoding/xml versiones anteriores a Go 1.17.12 y Go 1.18.4 permite a un atacante causar un p\u00e1nico debido al agotamiento de la pila por medio de unmarshal de un documento XML en una estructura Go que presenta un campo anidado que usa la etiqueta de campo 'any'"}], "id": "CVE-2022-30633", "lastModified": "2023-11-07T03:47:16.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-10T20:15:42.210", "references": [{"source": "security@golang.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://go.dev/cl/417061"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/issue/53611"}, {"source": "security@golang.org", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "url": "https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08"}, {"source": "security@golang.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"}, {"source": "security@golang.org", "tags": ["Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2022-0523"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}