Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade critUpgrade podmanUpgrade containers-commonUpgrade udicaUpgrade container-selinuxUpgrade libslirp-develUpgrade go-toolsetUpgrade buildahUpgrade golang-binUpgrade podman-catatonitUpgrade golang-docsUpgrade aardvark-dnsUpgrade golang-srcUpgrade criu-libsUpgrade grafanaUpgrade runcUpgrade podman-remoteUpgrade golangUpgrade buildah-testsUpgrade golang-testsUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade golang-raceUpgrade slirp4netnsUpgrade delveUpgrade podman-dockerUpgrade conmonUpgrade libslirpUpgrade python3-podmanUpgrade skopeo-testsUpgrade golang-miscUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade netavarkUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade criu-develUpgrade crunUpgrade podman-testsUpgrade skopeoUpgrade podman-pluginsUpgrade criuUpgrade toolbox | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-github-gorilla-mux-develUpgrade go-rpm-templatesUpgrade golang-googlecode-net-develUpgrade go-rpm-macrosUpgrade runcUpgrade golang-docsUpgrade golang-github-godbus-dbus-develUpgrade go-filesystemUpgrade runc-debuginfoUpgrade golang-sharedUpgrade golang-github-syndtr-gocapability-develUpgrade golist-debuginfoUpgrade golistUpgrade golang-binUpgrade golang-testsUpgrade golang-raceUpgrade go-srpm-macrosUpgrade golangUpgrade golang-googlecode-sqlite-develUpgrade golang-github-gorilla-context-develUpgrade golang-srcUpgrade golang-github-kr-pty-develUpgrade golang-misc | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golist-debuginfoUpgrade golang-raceUpgrade golistUpgrade golang-github-cpuguy83-md2manUpgrade golang-sharedUpgrade golangUpgrade golang-srcUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-docsUpgrade golang-miscUpgrade golang-binUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-testsUpgrade golang-github-cpuguy83-md2man-develUpgrade golist-debugsource | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade podman-gvproxyUpgrade buildah-testsUpgrade skopeo-debuginfoUpgrade libslirpUpgrade fuse-overlayfsUpgrade podman-debuginfoUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade podman-catatonitUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-pluginsUpgrade criuUpgrade skopeoUpgrade toolbox-debuginfoUpgrade podman-dockerUpgrade toolbox-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-testsUpgrade crunUpgrade buildahUpgrade conmon-debugsourceUpgrade critUpgrade netavarkUpgrade podmanUpgrade golang-testsUpgrade grafana-debuginfoUpgrade delve-debugsourceUpgrade slirp4netnsUpgrade python3-criuUpgrade udicaUpgrade podman-testsUpgrade runc-debugsourceUpgrade runcUpgrade conmon-debuginfoUpgrade golang-docsUpgrade criu-libs-debuginfoUpgrade buildah-debuginfoUpgrade conmonUpgrade podman-gvproxy-debuginfoUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade cockpit-podmanUpgrade golang-binUpgrade skopeo-debugsourceUpgrade libslirp-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade golang-raceUpgrade buildah-debugsourceUpgrade delve-debuginfoUpgrade python3-podmanUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade grafanaUpgrade go-toolsetUpgrade criu-develUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade golang-miscUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade golang-srcUpgrade golangUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade criu-debugsourceUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade containers-common | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go118Upgrade go117 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade golang-raceUpgrade buildah-testsUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade crunUpgrade slirp4netnsUpgrade podman-dockerUpgrade grafanaUpgrade go-toolsetUpgrade python3-podmanUpgrade conmonUpgrade container-selinuxUpgrade buildahUpgrade libslirpUpgrade udicaUpgrade python3-criuUpgrade podman-testsUpgrade aardvark-dnsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade golang-docsUpgrade podmanUpgrade fuse-overlayfsUpgrade critUpgrade golang-miscUpgrade criu-develUpgrade podman-pluginsUpgrade podman-catatonitUpgrade golang-srcUpgrade runcUpgrade golang-testsUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade golangUpgrade criuUpgrade containers-commonUpgrade criu-libsUpgrade skopeo-testsUpgrade netavarkUpgrade golang-binUpgrade libslirp-devel | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade skopeoUpgrade delve-debugsourceUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade conmon-debugsourceUpgrade fuse-overlayfsUpgrade conmonUpgrade cockpit-podmanUpgrade runcUpgrade buildah-tests-debuginfoUpgrade grafana-debuginfoUpgrade criuUpgrade aardvark-dnsUpgrade python3-podmanUpgrade podman-gvproxyUpgrade skopeo-debuginfoUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade golang-testsUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade golangUpgrade buildah-debuginfoUpgrade udicaUpgrade golang-miscUpgrade buildah-testsUpgrade criu-libs-debuginfoUpgrade critUpgrade netavarkNo solution existsUpgrade podman-dockerUpgrade buildahUpgrade podman-remoteUpgrade toolbox-debugsourceUpgrade golang-binUpgrade golang-docsUpgrade podmanUpgrade toolbox-testsUpgrade podman-catatonitUpgrade criu-debuginfoUpgrade golang-raceUpgrade toolboxUpgrade conmon-debuginfoUpgrade podman-catatonit-debuginfoUpgrade go-toolsetUpgrade slirp4netns-debugsourceUpgrade toolbox-debuginfoUpgrade criu-develUpgrade fuse-overlayfs-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade container-selinuxUpgrade runc-debuginfoUpgrade grafanaUpgrade podman-debugsourceUpgrade containers-commonUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade delveUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade crunUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade delve-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-srcUpgrade containernetworking-plugins-debugsourceUpgrade criu-libsUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade podman-pluginsUpgrade buildahUpgrade conmonUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade delveUpgrade golang-raceUpgrade buildah-testsUpgrade grafanaUpgrade toolboxUpgrade conmon-debuginfoUpgrade skopeo-debuginfoUpgrade podman-testsUpgrade slirp4netns-debugsourceUpgrade skopeo-debugsourceUpgrade crunUpgrade toolbox-testsUpgrade crun-debuginfoUpgrade go-toolsetUpgrade libslirpUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade podmanUpgrade toolbox-debuginfoUpgrade delve-debuginfoUpgrade podman-debugsourceUpgrade delve-debugsourceUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debugsourceUpgrade criuUpgrade podman-debuginfoUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade python3-criuUpgrade skopeo-testsUpgrade podman-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade crun-debugsourceUpgrade buildah-debuginfoUpgrade runcUpgrade buildah-tests-debuginfoUpgrade golang-binUpgrade podman-catatonitUpgrade containers-commonUpgrade podman-remoteUpgrade oci-seccomp-bpf-hookUpgrade libslirp-debuginfoUpgrade golangUpgrade criu-develUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade critUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade grafana-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade skopeoUpgrade criu-libs | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.18-docUpgrade go1.18-openssl-docUpgrade go1.17Upgrade go1.18-raceUpgrade go1.17-raceUpgrade go1.18-openssl-raceUpgrade go1.18-opensslUpgrade go1.17-docUpgrade go1.18 | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.13-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-srcUpgrade golang-1.18Upgrade golang-1.16-srcUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.16-goUpgrade golang-1.18-srcUpgrade golang-1.16Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-go (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub