Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-gvproxyUpgrade podman-pluginsUpgrade golang-raceUpgrade criu-develUpgrade conmonUpgrade criuUpgrade skopeoUpgrade skopeo-testsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade golang-miscUpgrade slirp4netnsUpgrade podman-testsUpgrade python3-podmanUpgrade netavarkUpgrade toolboxUpgrade delveUpgrade libslirpUpgrade crunUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade grafanaUpgrade golang-binUpgrade critUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade golang-testsUpgrade golang-docsUpgrade udicaUpgrade python3-criuUpgrade go-toolsetUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade containers-commonUpgrade runcUpgrade podman-remoteUpgrade golang-srcUpgrade libslirp-develUpgrade podmanUpgrade golangUpgrade buildah-testsUpgrade buildah | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade runc-debuginfoUpgrade go-rpm-templatesUpgrade golang-docsUpgrade go-filesystemUpgrade go-rpm-macrosUpgrade golist-debuginfoUpgrade golang-github-syndtr-gocapability-develUpgrade runcUpgrade golang-sharedUpgrade golang-github-godbus-dbus-develUpgrade golang-googlecode-net-develUpgrade golang-github-gorilla-mux-develUpgrade golang-miscUpgrade golistUpgrade golang-github-gorilla-context-develUpgrade golang-testsUpgrade go-srpm-macrosUpgrade golangUpgrade golang-raceUpgrade golang-googlecode-sqlite-develUpgrade golang-github-kr-pty-develUpgrade golang-binUpgrade golang-src | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-srcUpgrade golang-testsUpgrade golang-github-cpuguy83-md2man-develUpgrade golangUpgrade golist-debugsourceUpgrade golang-miscUpgrade golang-docsUpgrade golang-binUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golist-debuginfoUpgrade golang-github-cpuguy83-md2manUpgrade golang-sharedUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-raceUpgrade golist | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade golang-raceUpgrade criu-libsUpgrade buildah-debugsourceUpgrade python3-podmanUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade runc-debuginfoUpgrade delve-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade crun-debugsourceUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade container-selinuxUpgrade golang-miscUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade podman-plugins-debuginfoUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criu-debugsourceUpgrade podman-remote-debuginfoUpgrade golangUpgrade golang-srcUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containers-commonUpgrade grafanaUpgrade delveUpgrade go-toolsetUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade slirp4netns-debuginfoUpgrade criu-develUpgrade slirp4netns-debugsourceUpgrade podman-testsUpgrade golang-docsUpgrade golang-testsUpgrade conmonUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade skopeo-debuginfoUpgrade toolboxUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade podman-gvproxyUpgrade libslirp-debuginfoUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade podman-catatonitUpgrade libslirp-debugsourceUpgrade libslirpUpgrade buildah-testsUpgrade toolbox-debugsourceUpgrade critUpgrade podman-dockerUpgrade toolbox-debuginfoUpgrade skopeoUpgrade podmanUpgrade podman-gvproxy-debuginfoUpgrade toolbox-testsUpgrade delve-debugsourceUpgrade crunUpgrade buildahUpgrade runcUpgrade netavarkUpgrade grafana-debuginfoUpgrade golang-binUpgrade criu-libs-debuginfoUpgrade cockpit-podmanUpgrade runc-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debuginfoUpgrade criuUpgrade python3-criuUpgrade udica | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go117Upgrade go118 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golang-binUpgrade golang | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade buildahUpgrade python3-podmanUpgrade cockpit-podmanUpgrade buildah-testsUpgrade podman-gvproxyUpgrade golang-raceUpgrade udicaUpgrade podman-dockerUpgrade grafanaUpgrade container-selinuxUpgrade conmonUpgrade python3-criuUpgrade libslirpUpgrade aardvark-dnsUpgrade podman-testsUpgrade go-toolsetUpgrade slirp4netnsUpgrade crunUpgrade critUpgrade golang-miscUpgrade golang-binUpgrade golang-testsUpgrade libslirp-develUpgrade podmanUpgrade golang-docsUpgrade golangUpgrade delveUpgrade criuUpgrade podman-pluginsUpgrade netavarkUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade criu-develUpgrade skopeo-testsUpgrade containers-commonUpgrade criu-libsUpgrade golang-srcUpgrade podman-remote | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade crun-debugsourceUpgrade podman-pluginsUpgrade crunUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade golang-srcUpgrade containernetworking-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade buildah-debugsourceUpgrade python3-criuUpgrade podman-gvproxy-debuginfoUpgrade delveUpgrade podman-debugsourceUpgrade crun-debuginfoUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade libslirpUpgrade criu-develUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade delve-debuginfoUpgrade grafanaUpgrade criu-libsUpgrade runc-debuginfoUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade fuse-overlayfsUpgrade golang-docsUpgrade toolbox-testsUpgrade cockpit-podmanUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade criu-libs-debuginfoUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debuginfoUpgrade runcUpgrade grafana-debuginfoUpgrade criu-debuginfoUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade skopeo-debuginfoUpgrade criuUpgrade toolboxUpgrade skopeo-debugsourceUpgrade python3-podmanUpgrade aardvark-dnsUpgrade podman-testsUpgrade podmanUpgrade skopeoUpgrade podman-catatonitUpgrade golang-testsUpgrade podman-debuginfoUpgrade golangUpgrade conmon-debugsourceUpgrade podman-remoteUpgrade podman-dockerUpgrade toolbox-debugsourceUpgrade udicaUpgrade golang-miscNo solution existsUpgrade netavarkUpgrade buildah-testsUpgrade podman-gvproxyUpgrade critUpgrade conmonUpgrade delve-debugsourceUpgrade golang-binUpgrade golang-raceUpgrade buildah | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade go-toolsetUpgrade toolboxUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade buildah-testsUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-testsUpgrade conmonUpgrade buildahUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade crun-debuginfoUpgrade libslirpUpgrade skopeo-debugsourceUpgrade delveUpgrade grafanaUpgrade podman-testsUpgrade conmon-debuginfoUpgrade golang-raceUpgrade skopeo-debuginfoUpgrade runc-debuginfoUpgrade buildah-debuginfoUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade toolbox-debuginfoUpgrade delve-debugsourceUpgrade delve-debuginfoUpgrade critUpgrade buildah-tests-debuginfoUpgrade podmanUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade golang-binUpgrade buildah-debugsourceUpgrade skopeoUpgrade podman-remoteUpgrade libslirp-debuginfoUpgrade golangUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade containers-commonUpgrade criu-debugsourceUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade grafana-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfsUpgrade criu-libsUpgrade python3-criuUpgrade fuse-overlayfs-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade criuUpgrade toolbox-debugsourceUpgrade runc-debugsourceUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade runc | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17-docUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.18-raceUpgrade go1.18-docUpgrade go1.17Upgrade go1.18-openssl-raceUpgrade go1.17-raceUpgrade go1.18-openssl-doc | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.13Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13-goUpgrade golang-1.16-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.18-srcUpgrade golang-1.18Upgrade golang-1.18-goUpgrade golang-1.13-src (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub