Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-srcUpgrade oci-seccomp-bpf-hookUpgrade golang-docsUpgrade python3-criuUpgrade podman-catatonitUpgrade podman-remoteUpgrade critUpgrade udicaUpgrade criu-libsUpgrade grafanaUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade golang-testsUpgrade aardvark-dnsUpgrade libslirp-develUpgrade runcUpgrade buildahUpgrade go-toolsetUpgrade podmanUpgrade golang-binUpgrade container-selinuxUpgrade buildah-testsUpgrade golangUpgrade toolbox-testsUpgrade podman-pluginsUpgrade criuUpgrade golang-miscUpgrade toolboxUpgrade libslirpUpgrade netavarkUpgrade golang-raceUpgrade slirp4netnsUpgrade criu-develUpgrade podman-dockerUpgrade podman-gvproxyUpgrade crunUpgrade delveUpgrade conmonUpgrade cockpit-podmanUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade podman-testsUpgrade skopeoUpgrade python3-podman | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-sharedUpgrade runcUpgrade golang-github-godbus-dbus-develUpgrade golang-googlecode-net-develUpgrade go-filesystemUpgrade go-rpm-macrosUpgrade go-rpm-templatesUpgrade golang-github-gorilla-mux-develUpgrade golang-github-syndtr-gocapability-develUpgrade golist-debuginfoUpgrade runc-debuginfoUpgrade golistUpgrade golang-miscUpgrade golang-srcUpgrade golang-binUpgrade golang-github-gorilla-context-develUpgrade golang-testsUpgrade go-srpm-macrosUpgrade golang-raceUpgrade golang-github-kr-pty-develUpgrade golangUpgrade golang-googlecode-sqlite-devel | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-github-cpuguy83-md2man-develUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-binUpgrade golang-docsUpgrade golang-testsUpgrade golang-srcUpgrade golist-debugsourceUpgrade golangUpgrade golang-miscUpgrade golang-raceUpgrade golistUpgrade golang-github-cpuguy83-md2manUpgrade golist-debuginfoUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-shared | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade buildah-testsUpgrade slirp4netnsUpgrade libslirpUpgrade libslirp-debugsourceUpgrade conmon-debugsourceUpgrade libslirp-debuginfoUpgrade podman-catatonitUpgrade podman-gvproxyUpgrade podmanUpgrade toolbox-debugsourceUpgrade skopeo-debugsourceUpgrade golang-testsUpgrade netavarkUpgrade golang-binUpgrade runcUpgrade cockpit-podmanUpgrade conmon-debuginfoUpgrade criu-libs-debuginfoUpgrade runc-debugsourceUpgrade toolbox-testsUpgrade crunUpgrade grafana-debuginfoUpgrade buildah-debuginfoUpgrade toolboxUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criuUpgrade podman-debuginfoUpgrade skopeoUpgrade skopeo-debuginfoUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade critUpgrade containernetworking-plugins-debugsourceUpgrade golang-docsUpgrade podman-gvproxy-debuginfoUpgrade udicaUpgrade conmonUpgrade toolbox-debuginfoUpgrade buildahUpgrade podman-dockerUpgrade podman-testsUpgrade python3-criuUpgrade delve-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-debugsourceUpgrade grafanaUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade golang-srcUpgrade golangUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade runc-debuginfoUpgrade golang-miscUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade criu-debuginfoUpgrade criu-develUpgrade go-toolsetUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade delveUpgrade python3-podmanUpgrade podman-debugsourceUpgrade delve-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-raceUpgrade criu-libsUpgrade buildah-debugsourceUpgrade slirp4netns-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade container-selinux | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go118Upgrade go117 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golang-binUpgrade golang | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade criu-libsUpgrade containers-commonUpgrade podman-pluginsUpgrade podman-remoteUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade runcUpgrade golang-srcUpgrade criu-develUpgrade skopeo-testsUpgrade golang-testsUpgrade netavarkUpgrade criuUpgrade libslirp-develUpgrade podmanUpgrade golang-docsUpgrade podman-catatonitUpgrade golangUpgrade delveUpgrade golang-binUpgrade golang-miscUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade critUpgrade cockpit-podmanUpgrade grafanaUpgrade udicaUpgrade python3-criuUpgrade container-selinuxUpgrade podman-dockerUpgrade conmonUpgrade golang-raceUpgrade buildahUpgrade buildah-testsUpgrade libslirpUpgrade go-toolsetUpgrade python3-podmanUpgrade podman-testsUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade crunUpgrade podman-gvproxy | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade golang-binUpgrade golang-raceUpgrade buildahUpgrade grafana-debuginfoUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade conmonUpgrade runcUpgrade conmon-debuginfoUpgrade fuse-overlayfsUpgrade runc-debugsourceUpgrade netavarkUpgrade criuUpgrade critUpgrade podman-dockerUpgrade golang-miscUpgrade toolboxUpgrade toolbox-debugsourceUpgrade udicaUpgrade aardvark-dnsUpgrade buildah-testsUpgrade criu-libs-debuginfoUpgrade cockpit-podmanNo solution existsUpgrade skopeo-debuginfoUpgrade containernetworking-pluginsUpgrade golang-docsUpgrade slirp4netnsUpgrade podman-testsUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debuginfoUpgrade delve-debugsourceUpgrade podmanUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade podman-debuginfoUpgrade conmon-debugsourceUpgrade toolbox-testsUpgrade podman-remoteUpgrade python3-podmanUpgrade golang-testsUpgrade golangUpgrade skopeo-debugsourceUpgrade go-toolsetUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debuginfoUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debugsourceUpgrade criu-develUpgrade delve-debuginfoUpgrade delveUpgrade libslirp-develUpgrade grafanaUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade crun-debugsourceUpgrade golang-srcUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade buildah-debugsourceUpgrade podman-catatonit-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade container-selinuxUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade libslirpUpgrade slirp4netns-debuginfoUpgrade crun | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade fuse-overlayfsUpgrade criu-libsUpgrade buildah-debugsourceUpgrade podman-plugins-debuginfoUpgrade delve-debugsourceUpgrade golang-binUpgrade podman-debuginfoUpgrade podman-catatonit-debuginfoUpgrade runcUpgrade libslirp-develUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade containernetworking-pluginsUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-debugsourceUpgrade skopeoUpgrade toolbox-debugsourceUpgrade criuUpgrade grafana-debuginfoUpgrade podman-remoteUpgrade buildah-tests-debuginfoUpgrade critUpgrade toolbox-debuginfoUpgrade runc-debuginfoUpgrade delve-debuginfoUpgrade podmanUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade containers-commonUpgrade skopeo-testsUpgrade podman-catatonitUpgrade slirp4netns-debuginfoUpgrade golangUpgrade libslirp-debuginfoUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade skopeo-debugsourceUpgrade libslirpUpgrade conmon-debugsourceUpgrade slirp4netns-debugsourceUpgrade delveUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade buildah-testsUpgrade podman-pluginsUpgrade buildahUpgrade toolbox-testsUpgrade podman-testsUpgrade grafanaUpgrade skopeo-debuginfoUpgrade golang-raceUpgrade slirp4netnsUpgrade go-toolsetUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade crun-debuginfoUpgrade crun | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.18Upgrade go1.17-docUpgrade go1.18-opensslUpgrade go1.18-raceUpgrade go1.18-openssl-raceUpgrade go1.18-docUpgrade go1.17Upgrade go1.17-raceUpgrade go1.18-openssl-doc | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.16-srcUpgrade golang-1.18Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.18-goUpgrade golang-1.13-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13Upgrade golang-1.13 (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub