CVE-2022-28131 Stack exhaustion from deeply nested XML documents in encoding/xml
HighCVSS 7.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stdlib(Go) | < 1.17.12 | 1.17.12 |
| stdlib(Go) | >= 1.18.0-0, < 1.18.4 | 1.18.4 |
| debian/golang-1.15(Debian:11) | All versions | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-1 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-1~deb11u1 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-1~deb11u2 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-1~deb11u3 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-1~deb11u4 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-2 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-3 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-4 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.15-5 | No fix listed |
| debian/golang-1.15(Debian:11) | = 1.15.9-6 | No fix listed |
| encoding/xml(Go) | < 1.17.12 | 1.17.12 |
| encoding/xml(Go) | >= 1.18.0-0, < 1.18.4 | 1.18.4 |
| ubuntu/golang-1.13(Ubuntu:22.04) | < 1.13.8-1ubuntu2.22.04.2 | 1.13.8-1ubuntu2.22.04.2 |
| ubuntu/golang-1.18(Ubuntu:22.04) | < 1.18.1-1ubuntu1.1 | 1.18.1-1ubuntu1.1 |
| golang go | < 1.17.12 | 1.17.12 |
| golang go | >= 1.18.0, < 1.18.4 | 1.18.4 |
| fedoraproject fedora | = 35 | No fix listed |
| netapp cloud insights telegraf | All versions | No fix listed |
| alpine/go(Alpine:v3.16) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
| alpine/go(Alpine:v3.17) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
| alpine/go(Alpine:v3.18) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
| alpine/go(Alpine:v3.19) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/go(Alpine:v3.20) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
| alpine/go(Alpine:v3.21) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
| alpine/go(Alpine:v3.22) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
| alpine/go(Alpine:v3.23) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
| alpine/go(Alpine:v3.24) | >= 1.18.0, < 1.18.4-r0 | 1.18.4-r0 |
References
- go.dev patch
- go.googlesource.com patch
- go.dev issue-tracking
- groups.google.com
- security-tracker.debian.org vendor-advisory
- pkg.go.dev
- Ubuntu CVE tracker vendor-advisory
- USN-6038-1 vendor-advisory
- USN-6038-2 vendor-advisory
- www.cve.org
- security.alpinelinux.org vendor-advisory