Vulnerability · Published Apr 20, 2022 · Assigned by mitre
CVE-2022-24675
High 7.5
In plain English
A high-severity security flaw in the go package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.0% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)10.0%top 4.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | go | 1.18.1-r0 | ALPINE-CVE-2022-24675 |
| Alpine:v3.21 | go | 1.18.1-r0 | ALPINE-CVE-2022-24675 |
| Alpine:v3.22 | go | 1.18.1-r0 | ALPINE-CVE-2022-24675 |
| Alpine:v3.23 | go | 1.18.1-r0 | ALPINE-CVE-2022-24675 |
| Alpine:v3.24 | go | 1.18.1-r0 | ALPINE-CVE-2022-24675 |
| Go | stdlib | 1.17.9, 1.18.1 | GO-2022-0433 |
| Rocky Linux:8 | delve | 0:1.7.2-1.module+el8.6.0+824+8e984c20 | RLSA-2022:5337 |
| Rocky Linux:8 | go-toolset | 0:1.17.10-1.module+el8.6.0+986+efe4cea4 | RLSA-2022:5337 |
| Rocky Linux:9 | go-toolset | 0:1.17.12-1.el9_0 | RLSA-2022:5799 |
| Rocky Linux:8 | golang | 0:1.17.10-1.module+el8.6.0+986+efe4cea4 | RLSA-2022:5337 |
| Rocky Linux:9 | golang | 0:1.17.12-1.el9_0 | RLSA-2022:5799 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2022-24675 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1 | UBUNTU-CVE-2022-24675 |
Affected products (as reported)
References
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/oecdBNLOml8
- FEDORA-2022-a49babed75 vendor-advisory
- FEDORA-2022-c0f780ecf1 vendor-advisory
- FEDORA-2022-e46e6e8317 vendor-advisory
- FEDORA-2022-fae3ecee19 vendor-advisory
- FEDORA-2022-ba365d3703 vendor-advisory
- GLSA-202208-02 vendor-advisory
- FEDORA-2022-30c5ed5625 vendor-advisory
- https://security.netapp.com/advisory/ntap-20220915-0010/
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf