CVE-2022-30635 - OpenCVE

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Golang	Go

Configuration 1 [-]

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

References

Link	Resource
https://go.dev/cl/417064	Patch Vendor Advisory
https://go.dev/issue/53615	Issue Tracking Vendor Advisory
https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7	Mailing List Patch Vendor Advisory
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE	Mailing List Vendor Advisory
https://pkg.go.dev/vuln/GO-2022-0526	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: Go

Published: 2022-08-09T20:16:05

Updated: 2023-06-12T19:04:46.476Z

Reserved: 2022-05-12T00:00:00

Link: CVE-2022-30635

JSON object: View

NVD Information

Status : Modified

Published: 2022-08-10T20:15:42.640

Modified: 2023-11-07T03:47:17.070

Link: CVE-2022-30635

JSON object: View

Redhat Information

No data.

CWE

CWE-674

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "646881F6-A299-4D92-A1F3-E95959FA426F", "versionEndExcluding": "1.17.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE088A2D-7894-4A48-887C-36DD727A7BEB", "versionEndExcluding": "1.18.4", "versionStartIncluding": "1.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures."}, {"lang": "es", "value": "Una recursi\u00f3n no controlada en el archivo Decoder.Decode en encoding/gob versiones anteriores a Go 1.17.12 y Go 1.18.4, permite a un atacante causar un p\u00e1nico debido al agotamiento de la pila por medio de un mensaje que contiene estructuras profundamente anidadas"}], "id": "CVE-2022-30635", "lastModified": "2023-11-07T03:47:17.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-10T20:15:42.640", "references": [{"source": "security@golang.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://go.dev/cl/417064"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/issue/53615"}, {"source": "security@golang.org", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "url": "https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7"}, {"source": "security@golang.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"}, {"source": "security@golang.org", "tags": ["Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2022-0526"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "nvd@nist.gov", "type": "Primary"}]}