En resumen
- CVE-2022-2879 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a stdlib, go (golang).
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.0%, mayor que el 80.8% de las vulnerabilidades.
- Solución: actualizar a 1.19.2, 1.18.7 o posterior.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.19.0-0, < 1.19.2< 1.18.7
| 1.19.21.18.7
|
| go | ≥ 1.19.0, < 1.19.2< 1.18.7
| 1.19.21.18.7
|
Description
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
NVD description
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free