Vulnerability · Published Apr 20, 2022 · Assigned by mitre
CVE-2022-28327
High 7.5
In plain English
A high-severity security flaw in the go package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.2%top 9.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | go | 1.18.1-r0 | ALPINE-CVE-2022-28327 |
| Alpine:v3.21 | go | 1.18.1-r0 | ALPINE-CVE-2022-28327 |
| Alpine:v3.22 | go | 1.18.1-r0 | ALPINE-CVE-2022-28327 |
| Alpine:v3.23 | go | 1.18.1-r0 | ALPINE-CVE-2022-28327 |
| Alpine:v3.24 | go | 1.18.1-r0 | ALPINE-CVE-2022-28327 |
| Go | stdlib | 1.17.9, 1.18.1 | GO-2022-0435 |
| Rocky Linux:8 | delve | 0:1.7.2-1.module+el8.6.0+824+8e984c20 | RLSA-2022:5337 |
| Rocky Linux:8 | go-toolset | 0:1.17.10-1.module+el8.6.0+986+efe4cea4 | RLSA-2022:5337 |
| Rocky Linux:9 | go-toolset | 0:1.17.12-1.el9_0 | RLSA-2022:5799 |
| Rocky Linux:8 | golang | 0:1.17.10-1.module+el8.6.0+986+efe4cea4 | RLSA-2022:5337 |
| Rocky Linux:9 | golang | 0:1.17.12-1.el9_0 | RLSA-2022:5799 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2022-28327 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1 | UBUNTU-CVE-2022-28327 |
Affected products (as reported)
References
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/oecdBNLOml8
- FEDORA-2022-a49babed75 vendor-advisory
- FEDORA-2022-53f0c619c5 vendor-advisory
- FEDORA-2022-c0f780ecf1 vendor-advisory
- FEDORA-2022-e46e6e8317 vendor-advisory
- FEDORA-2022-fae3ecee19 vendor-advisory
- FEDORA-2022-ba365d3703 vendor-advisory
- GLSA-202208-02 vendor-advisory
- FEDORA-2022-30c5ed5625 vendor-advisory
- https://security.netapp.com/advisory/ntap-20220915-0010/
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf