En bref
- CVE-2022-2879 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant stdlib, go (golang).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.0%, plus élevée que 80.8% des vulnérabilités.
- Correctif : mettre à jour vers 1.19.2, 1.18.7 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.19.0-0, < 1.19.2< 1.18.7
| 1.19.21.18.7
|
| go | ≥ 1.19.0, < 1.19.2< 1.18.7
| 1.19.21.18.7
|
Description
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
NVD description
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free