Fluid Attacks Database

Description

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	stdlib	>=0 <1.17.13	1.17.13
debian 12	golang-1.19	>=0 <1.19-1	1.19-1
debian 11	golang-1.15	=1.15.15-1 \|\| =1.15.15-1~deb11u1 \|\| =1.15.15-1~deb11u2 \|\| =1.15.15-1~deb11u3 \|\| =1.15.15-1~deb11u4 \|\| =1.15.15-2 \|\| =1.15.15-3 \|\| =1.15.15-4 \|\| =1.15.15-5 \|\| =1.15.9-6	-
rpm rhel8	containernetworking-plugins	-	-
rpm rhel9	toolbox	<0:0.0.99.3-9.el9	0:0.0.99.3-9.el9
rpm rhel8	grafana-pcp	-	-
rpm rhel8	toolbox	-	-
rpm rhel9	buildah	-	-
rpm rhel9	butane	<0:0.16.0-1.el9	0:0.16.0-1.el9
rpm rhel9	containernetworking-plugins	-	-

1-10 of 29

Aliases

1. CVE-2022-321892. NVD-2022-321893. OSV-GO-2022-05374. OSV-2022-321895. OSV-DEBIAN-2022-321896. GCVE-2022-321897. SECURITY-TRACKER-CVE-2022-32189

References

1. https://go.dev/cl/4177742. https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc663. https://go.dev/issue/538714. https://groups.google.com/g/golang-announce/c/YqYYG87xB10

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.