Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade netavarkUpgrade golang-raceUpgrade crunUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade criuUpgrade podman-dockerUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade python3-podmanUpgrade delveUpgrade toolboxUpgrade criu-develUpgrade conmonUpgrade golang-miscUpgrade podman-testsUpgrade toolbox-testsUpgrade slirp4netnsUpgrade skopeoUpgrade containers-commonUpgrade golang-binUpgrade python3-criuUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade go-toolsetUpgrade golangUpgrade podman-catatonitUpgrade golang-testsUpgrade podmanUpgrade runcUpgrade golang-srcUpgrade libslirp-develUpgrade buildahUpgrade podman-remoteUpgrade criu-libsUpgrade golang-docsUpgrade critUpgrade container-selinuxUpgrade udicaUpgrade grafana | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-googlecode-net-develUpgrade golang-github-godbus-dbus-develUpgrade golang-github-gorilla-mux-develUpgrade golist-debuginfoUpgrade go-rpm-macrosUpgrade golang-github-syndtr-gocapability-develUpgrade golang-docsUpgrade go-filesystemUpgrade runcUpgrade runc-debuginfoUpgrade go-rpm-templatesUpgrade golang-sharedUpgrade golang-miscUpgrade golang-binUpgrade golang-github-kr-pty-develUpgrade golang-github-gorilla-context-develUpgrade golang-srcUpgrade golangUpgrade golistUpgrade go-srpm-macrosUpgrade golang-raceUpgrade golang-testsUpgrade golang-googlecode-sqlite-devel | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golist-debugsourceUpgrade golang-testsUpgrade golang-github-cpuguy83-md2man-develUpgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-docsUpgrade golang-binUpgrade golang-github-cpuguy83-md2manUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-sharedUpgrade golistUpgrade golang-raceUpgrade golist-debuginfo | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade buildahUpgrade delve-debugsourceUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade skopeo-debugsourceUpgrade crunUpgrade podmanUpgrade podman-dockerUpgrade critUpgrade toolbox-debugsourceUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade criuUpgrade skopeo-debuginfoUpgrade runcUpgrade conmon-debuginfoUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golang-binUpgrade golang-testsUpgrade criu-libs-debuginfoUpgrade grafana-debuginfoUpgrade buildah-debuginfoUpgrade cockpit-podmanUpgrade netavarkUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade slirp4netnsUpgrade podman-catatonitUpgrade containernetworking-plugins-debugsourceUpgrade python3-criuUpgrade conmonUpgrade libslirp-debugsourceUpgrade runc-debugsourceUpgrade golang-docsUpgrade buildah-testsUpgrade libslirpUpgrade podman-testsUpgrade udicaUpgrade podman-gvproxy-debuginfoUpgrade toolboxUpgrade skopeoUpgrade toolbox-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade buildah-tests-debuginfoUpgrade crun-debuginfoUpgrade aardvark-dnsUpgrade container-selinuxUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade containers-commonUpgrade go-toolsetUpgrade criu-develUpgrade grafanaUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade golang-miscUpgrade criu-debuginfoUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade criu-debugsourceUpgrade golang-raceUpgrade criu-libsUpgrade buildah-debugsourceUpgrade python3-podmanUpgrade delve-debuginfoUpgrade golangUpgrade containernetworking-plugins-debuginfoUpgrade podman-debugsourceUpgrade podman-plugins-debuginfoUpgrade golang-src | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go118Upgrade go117 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golangUpgrade golang-binUpgrade golang-src | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade criu-develUpgrade criu-libsUpgrade containers-commonUpgrade golang-srcUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade podman-remoteUpgrade podman-catatonitUpgrade critUpgrade delveUpgrade podmanUpgrade netavarkUpgrade golang-testsUpgrade golang-docsUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade golang-binUpgrade golangUpgrade podman-pluginsUpgrade golang-miscUpgrade runcUpgrade criuUpgrade python3-podmanUpgrade go-toolsetUpgrade crunUpgrade slirp4netnsUpgrade libslirpUpgrade python3-criuUpgrade conmonUpgrade golang-raceUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade buildah-testsUpgrade aardvark-dnsUpgrade podman-testsUpgrade grafanaUpgrade podman-dockerUpgrade buildahUpgrade container-selinuxUpgrade udica | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade buildah-tests-debuginfoUpgrade conmonUpgrade criu-debuginfoNo solution existsUpgrade criu-debugsourceUpgrade delve-debugsourceUpgrade skopeoUpgrade golang-testsUpgrade slirp4netnsUpgrade podman-catatonitUpgrade runc-debugsourceUpgrade toolboxUpgrade python3-podmanUpgrade toolbox-testsUpgrade conmon-debuginfoUpgrade skopeo-debuginfoUpgrade golang-docsUpgrade criuUpgrade containernetworking-pluginsUpgrade skopeo-debugsourceUpgrade conmon-debugsourceUpgrade golangUpgrade aardvark-dnsUpgrade podman-testsUpgrade golang-binUpgrade criu-libs-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade buildah-debuginfoUpgrade runcUpgrade buildah-testsUpgrade critUpgrade golang-miscUpgrade netavarkUpgrade podman-dockerUpgrade udicaUpgrade toolbox-debugsourceUpgrade golang-raceUpgrade libslirp-debuginfoUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade podmanUpgrade podman-debuginfoUpgrade grafana-debuginfoUpgrade podman-remoteUpgrade podman-gvproxyUpgrade criu-libsUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade delveUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade criu-develUpgrade libslirpUpgrade toolbox-debuginfoUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade golang-srcUpgrade containernetworking-plugins-debugsourceUpgrade podman-pluginsUpgrade slirp4netns-debuginfoUpgrade crun-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade delve-debuginfoUpgrade crunUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade grafanaUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containers-commonUpgrade python3-criuUpgrade container-selinuxUpgrade podman-debugsourceUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade podman-catatonit-debuginfo | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade slirp4netnsUpgrade go-toolsetUpgrade containernetworking-plugins-debugsourceUpgrade buildahUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-testsUpgrade golang-raceUpgrade grafanaUpgrade skopeo-debuginfoUpgrade conmon-debuginfoUpgrade toolboxUpgrade podman-pluginsUpgrade podman-testsUpgrade slirp4netns-debugsourceUpgrade crunUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade libslirpUpgrade delveUpgrade skopeo-debugsourceUpgrade conmon-debugsourceUpgrade toolbox-testsUpgrade conmonUpgrade skopeoUpgrade delve-debuginfoUpgrade buildah-debugsourceUpgrade podman-debugsourceUpgrade buildah-tests-debuginfoUpgrade toolbox-debuginfoUpgrade podmanUpgrade critUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-remote-debuginfoUpgrade buildah-debuginfoUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade criu-debugsourceUpgrade containers-commonUpgrade podman-remoteUpgrade libslirp-debuginfoUpgrade golangUpgrade criu-debuginfoUpgrade delve-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade golang-binUpgrade criuUpgrade runc-debugsourceUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade criu-libsUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade grafana-debuginfoUpgrade python3-criu | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.18-opensslUpgrade go1.17-docUpgrade go1.18Upgrade go1.17Upgrade go1.18-raceUpgrade go1.18-openssl-docUpgrade go1.18-docUpgrade go1.18-openssl-raceUpgrade go1.17-race | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13-goUpgrade golang-1.13Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.18Upgrade golang-1.16Upgrade golang-1.18-srcUpgrade golang-1.16-srcUpgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub