Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade critUpgrade udicaUpgrade python3-criuUpgrade golang-srcUpgrade golang-binUpgrade podman-catatonitUpgrade container-selinuxUpgrade buildahUpgrade podman-remoteUpgrade golang-testsUpgrade golang-docsUpgrade golangUpgrade libslirp-develUpgrade grafanaUpgrade criu-libsUpgrade go-toolsetUpgrade buildah-testsUpgrade aardvark-dnsUpgrade runcUpgrade podmanUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade slirp4netnsUpgrade crunUpgrade golang-miscUpgrade golang-raceUpgrade netavarkUpgrade skopeoUpgrade cockpit-podmanUpgrade criuUpgrade toolbox-testsUpgrade podman-pluginsUpgrade toolboxUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade python3-podmanUpgrade podman-dockerUpgrade libslirpUpgrade delveUpgrade fuse-overlayfsUpgrade conmonUpgrade podman-testsUpgrade criu-devel | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-googlecode-sqlite-develUpgrade golang-testsUpgrade golang-srcUpgrade golang-raceUpgrade go-srpm-macrosUpgrade golang-github-gorilla-context-develUpgrade golang-miscUpgrade golistUpgrade golang-github-kr-pty-develUpgrade golangUpgrade golang-binUpgrade runc-debuginfoUpgrade golang-sharedUpgrade golang-github-gorilla-mux-develUpgrade golang-googlecode-net-develUpgrade go-filesystemUpgrade golang-github-godbus-dbus-develUpgrade golang-docsUpgrade golang-github-syndtr-gocapability-develUpgrade go-rpm-macrosUpgrade golist-debuginfoUpgrade go-rpm-templatesUpgrade runc | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golistUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-raceUpgrade golist-debuginfoUpgrade golang-github-cpuguy83-md2manUpgrade golang-sharedUpgrade golist-debugsourceUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-miscUpgrade golangUpgrade golang-docsUpgrade golang-binUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-srcUpgrade golang-github-cpuguy83-md2man-develUpgrade golang-tests | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade crunUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-testsUpgrade buildahUpgrade delve-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade critUpgrade buildah-testsUpgrade libslirpUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade golang-binUpgrade golang-testsUpgrade podmanUpgrade slirp4netnsUpgrade toolboxUpgrade podman-gvproxyUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade podman-catatonitUpgrade cockpit-podmanUpgrade podman-dockerUpgrade grafana-debuginfoUpgrade netavarkUpgrade runc-debugsourceUpgrade conmon-debuginfoUpgrade criuUpgrade fuse-overlayfsUpgrade runcUpgrade skopeo-debugsourceUpgrade golang-docsUpgrade podman-testsUpgrade conmonUpgrade skopeo-debuginfoUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade conmon-debugsourceUpgrade skopeoUpgrade udicaUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade toolbox-debugsourceUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criu-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade container-selinuxUpgrade podman-pluginsUpgrade crun-debugsourceUpgrade golangUpgrade podman-remote-debuginfoUpgrade aardvark-dnsUpgrade buildah-tests-debuginfoUpgrade golang-raceUpgrade criu-libsUpgrade buildah-debugsourceUpgrade criu-develUpgrade grafanaUpgrade go-toolsetUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade golang-miscUpgrade criu-debuginfoUpgrade skopeo-testsUpgrade podman-debugsourceUpgrade delve-debuginfoUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade delveUpgrade containers-commonUpgrade golang-srcUpgrade podman-plugins-debuginfo | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go118Upgrade go117 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade golang-miscUpgrade golang-binUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade criuUpgrade netavarkUpgrade golang-srcUpgrade criu-develUpgrade criu-libsUpgrade podman-remoteUpgrade skopeo-testsUpgrade containers-commonUpgrade delveUpgrade golangUpgrade golang-docsUpgrade libslirp-develUpgrade runcUpgrade podmanUpgrade critUpgrade golang-testsUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxyUpgrade python3-criuUpgrade container-selinuxUpgrade conmonUpgrade aardvark-dnsUpgrade udicaUpgrade buildah-testsUpgrade golang-raceUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade podman-dockerUpgrade grafanaUpgrade podman-testsUpgrade buildahUpgrade libslirpUpgrade crunUpgrade python3-podmanUpgrade go-toolset | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade podman-gvproxyUpgrade python3-podmanUpgrade skopeo-debugsourceUpgrade toolboxUpgrade golang-binUpgrade buildahUpgrade buildah-debuginfoUpgrade golang-miscUpgrade podman-dockerUpgrade netavarkUpgrade toolbox-debugsourceUpgrade golang-raceUpgrade critUpgrade udicaUpgrade cockpit-podmanUpgrade criu-libs-debuginfoUpgrade aardvark-dnsUpgrade runcUpgrade criu-debugsourceUpgrade golangUpgrade golang-testsUpgrade skopeo-debuginfoUpgrade conmon-debuginfoUpgrade podman-remoteUpgrade criuUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfsUpgrade podman-testsUpgrade conmonUpgrade buildah-testsNo solution existsUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade skopeoUpgrade slirp4netnsUpgrade delve-debugsourceUpgrade runc-debugsourceUpgrade golang-docsUpgrade podmanUpgrade conmon-debugsourceUpgrade libslirp-debuginfoUpgrade grafana-debuginfoUpgrade criu-debuginfoUpgrade podman-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-testsUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirpUpgrade criu-develUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debuginfoUpgrade go-toolsetUpgrade skopeo-testsUpgrade delveUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade grafanaUpgrade criu-libsUpgrade containers-commonUpgrade libslirp-develUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade podman-plugins-debuginfoUpgrade delve-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade golang-srcUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade podman-catatonit-debuginfo | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade delveUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade toolbox-testsUpgrade slirp4netns-debugsourceUpgrade buildahUpgrade slirp4netnsUpgrade buildah-testsUpgrade containernetworking-plugins-debugsourceUpgrade podman-pluginsUpgrade conmon-debuginfoUpgrade golang-raceUpgrade toolboxUpgrade conmon-debugsourceUpgrade podman-testsUpgrade grafanaUpgrade skopeo-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-debugsourceUpgrade crunUpgrade crun-debuginfoUpgrade libslirpUpgrade go-toolsetUpgrade podman-remoteUpgrade golang-binUpgrade criu-develUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade criu-debuginfoUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade slirp4netns-debuginfoUpgrade criuUpgrade delve-debugsourceUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade runc-debugsourceUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade podman-debugsourceUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade grafana-debuginfoUpgrade fuse-overlayfsUpgrade criu-libsUpgrade delve-debuginfoUpgrade podmanUpgrade buildah-tests-debuginfoUpgrade toolbox-debuginfoUpgrade critUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade golangUpgrade oci-seccomp-bpf-hookUpgrade podman-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade crun-debugsourceUpgrade buildah-debuginfoUpgrade runcUpgrade skopeoUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfo | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.18-openssl-docUpgrade go1.18-docUpgrade go1.17Upgrade go1.18-raceUpgrade go1.18-openssl-raceUpgrade go1.17-raceUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.17-doc | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.16-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.18-srcUpgrade golang-1.18Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-go | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub