Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade podman-pluginsUpgrade golang-raceUpgrade podman-gvproxyUpgrade criu-develUpgrade toolbox-testsUpgrade skopeoUpgrade criuUpgrade crunUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade toolboxUpgrade python3-podmanUpgrade golang-miscUpgrade podman-testsUpgrade slirp4netnsUpgrade skopeo-testsUpgrade conmonUpgrade delveUpgrade netavarkUpgrade golang-srcUpgrade containers-commonUpgrade golang-binUpgrade criu-libsUpgrade aardvark-dnsUpgrade golang-testsUpgrade runcUpgrade podman-catatonitUpgrade python3-criuUpgrade buildah-testsUpgrade golang-docsUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade golangUpgrade podmanUpgrade go-toolsetUpgrade podman-remoteUpgrade container-selinuxUpgrade udicaUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade grafanaUpgrade buildah | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-googlecode-sqlite-develUpgrade golang-srcUpgrade golang-binUpgrade golang-github-gorilla-context-develUpgrade golistUpgrade golangUpgrade golang-miscUpgrade golang-testsUpgrade go-srpm-macrosUpgrade golang-raceUpgrade golang-github-kr-pty-develUpgrade go-rpm-templatesUpgrade golang-sharedUpgrade golang-docsUpgrade runcUpgrade golist-debuginfoUpgrade go-rpm-macrosUpgrade golang-github-godbus-dbus-develUpgrade golang-github-gorilla-mux-develUpgrade go-filesystemUpgrade runc-debuginfoUpgrade golang-googlecode-net-develUpgrade golang-github-syndtr-gocapability-devel | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-github-cpuguy83-md2manUpgrade golist-debuginfoUpgrade golang-raceUpgrade golistUpgrade golang-sharedUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-srcUpgrade golist-debugsourceUpgrade golang-docsUpgrade golangUpgrade golang-github-cpuguy83-md2man-develUpgrade golang-testsUpgrade golang-miscUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-bin | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade runc-debuginfoUpgrade aardvark-dnsUpgrade slirp4netns-debugsourceUpgrade buildah-tests-debuginfoUpgrade criu-develUpgrade go-toolsetUpgrade grafanaUpgrade delveUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfoUpgrade slirp4netns-debuginfoUpgrade criu-debugsourceUpgrade crun-debuginfoUpgrade podman-debugsourceUpgrade golangUpgrade libslirp-develUpgrade python3-podmanUpgrade delve-debuginfoUpgrade podman-pluginsUpgrade golang-srcUpgrade criu-debuginfoUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade criu-libsUpgrade golang-raceUpgrade skopeo-testsUpgrade podman-plugins-debuginfoUpgrade golang-miscUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade libslirpUpgrade buildah-testsUpgrade podmanUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade critUpgrade fuse-overlayfsUpgrade criuUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-debuginfoUpgrade toolbox-debuginfoUpgrade slirp4netnsUpgrade toolboxUpgrade runc-debugsourceUpgrade runcUpgrade netavarkUpgrade golang-testsUpgrade golang-binUpgrade criu-libs-debuginfoUpgrade conmon-debuginfoUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade grafana-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debugsourceUpgrade conmon-debugsourceUpgrade skopeo-debugsourceUpgrade podman-gvproxyUpgrade crunUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade delve-debugsourceUpgrade buildahUpgrade conmonUpgrade python3-criuUpgrade udicaUpgrade podman-testsUpgrade golang-docsUpgrade toolbox-debugsourceUpgrade podman-dockerUpgrade skopeo | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go117Upgrade go118 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade podman-remoteUpgrade runcUpgrade golang-testsUpgrade podman-pluginsUpgrade golangUpgrade containernetworking-pluginsUpgrade delveUpgrade criu-develUpgrade golang-miscUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade golang-binUpgrade containers-commonUpgrade netavarkUpgrade skopeo-testsUpgrade criuUpgrade podmanUpgrade critUpgrade skopeoUpgrade fuse-overlayfsUpgrade criu-libsUpgrade libslirp-develUpgrade golang-srcUpgrade golang-docsUpgrade python3-criuUpgrade podman-dockerUpgrade slirp4netnsUpgrade container-selinuxUpgrade libslirpUpgrade buildahUpgrade crunUpgrade grafanaUpgrade buildah-testsUpgrade golang-raceUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade podman-testsUpgrade aardvark-dnsUpgrade python3-podmanUpgrade go-toolsetUpgrade udicaUpgrade conmon | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade slirp4netns-debugsourceUpgrade golang-srcUpgrade fuse-overlayfs-debugsourceUpgrade crun-debuginfoUpgrade podman-catatonit-debuginfoUpgrade container-selinuxUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade buildah-debugsourceUpgrade crun-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade delve-debuginfoUpgrade criu-develUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-criuUpgrade libslirpUpgrade podman-pluginsUpgrade crunUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade containers-commonUpgrade criu-libsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-debugsourceUpgrade go-toolsetUpgrade delveUpgrade grafanaUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade buildahUpgrade golang-miscUpgrade toolbox-debugsourceUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsNo solution existsUpgrade podman-dockerUpgrade netavarkUpgrade critUpgrade toolbox-testsUpgrade golang-docsUpgrade aardvark-dnsUpgrade criu-libs-debuginfoUpgrade golang-raceUpgrade criu-debugsourceUpgrade criuUpgrade golang-binUpgrade toolboxUpgrade python3-podmanUpgrade skopeo-debugsourceUpgrade podman-debuginfoUpgrade skopeo-debuginfoUpgrade golangUpgrade udicaUpgrade buildah-testsUpgrade podman-catatonitUpgrade conmon-debugsourceUpgrade podman-remoteUpgrade podmanUpgrade golang-testsUpgrade podman-gvproxyUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade grafana-debuginfoUpgrade runcUpgrade conmon-debuginfoUpgrade conmonUpgrade fuse-overlayfsUpgrade skopeoUpgrade buildah-tests-debuginfoUpgrade cockpit-podmanUpgrade podman-testsUpgrade delve-debugsource | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade buildah-debugsourceUpgrade podman-catatonitUpgrade golangUpgrade libslirp-debuginfoUpgrade skopeoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade criu-develUpgrade containers-commonUpgrade podman-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debuginfoUpgrade golang-binUpgrade podman-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade criuUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade runcUpgrade buildah-debuginfoUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade podman-debugsourceUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfsUpgrade grafana-debuginfoUpgrade criu-libsUpgrade podmanUpgrade critUpgrade fuse-overlayfs-debugsourceUpgrade delve-debuginfoUpgrade buildah-tests-debuginfoUpgrade toolbox-debuginfoUpgrade skopeo-debuginfoUpgrade toolboxUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade go-toolsetUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debugsourceUpgrade buildahUpgrade delveUpgrade conmonUpgrade toolbox-testsUpgrade containernetworking-plugins-debuginfoUpgrade buildah-testsUpgrade podman-pluginsUpgrade skopeo-debugsourceUpgrade libslirpUpgrade crun-debuginfoUpgrade crunUpgrade grafanaUpgrade podman-testsUpgrade golang-raceUpgrade conmon-debuginfo | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17-docUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.18-raceUpgrade go1.17-raceUpgrade go1.18-docUpgrade go1.18-openssl-docUpgrade go1.17Upgrade go1.18-openssl-race | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.13Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.16-srcUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.16Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.18-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-go | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub