In breve
- CVE-2022-2879 è una vulnerabilità ALTO (CVSS 7.5) che riguarda stdlib, go (golang).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.0%, superiore al 80.8% delle vulnerabilità.
- Correzione: aggiornare a 1.19.2, 1.18.7 o successiva.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.19.0-0, < 1.19.2< 1.18.7
| 1.19.21.18.7
|
| go | ≥ 1.19.0, < 1.19.2< 1.18.7
| 1.19.21.18.7
|
Description
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
NVD description
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free