CVE-2022-2879 vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 Mi...

Golang Go

7.5

CVSSv3

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can ex...

Golang Go

7.5

CVSSv3

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively sm...

Golang Go

5.3

CVSSv3

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the s...

Golang Go Golang Http2 Fedoraproject Fedora 37 Fedoraproject Fedora 38

1 Github repository

7.5

CVSSv3

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy s...

Golang Go

4.8

CVSSv3

Go prior to 1.16.12 and 1.17.x prior to 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

Golang Go Debian Debian Linux 9.0

7.5

CVSSv3

Rat.SetString in math/big in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -Debian Debian Linux 9.0

5 Github repositories

7.5

CVSSv3

cmd/go in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -

4 Github repositories

9.1

CVSSv3

Curve.IsOnCurve in crypto/elliptic in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -Debian Debian Linux 9.0

3 Github repositories

7.5

CVSSv3

ImportedSymbols in debug/macho (for Open or OpenFat) in Go prior to 1.16.10 and 1.17.x prior to 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Golang Go Fedoraproject Fedora 34 Fedoraproject Fedora 35 Debian Debian Linux 9.0

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook