Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slirp4netnsUpgrade toolboxUpgrade golang-miscUpgrade golang-raceUpgrade toolbox-testsUpgrade netavarkUpgrade skopeoUpgrade python3-podmanUpgrade criuUpgrade criu-develUpgrade delveUpgrade cockpit-podmanUpgrade skopeo-testsUpgrade podman-pluginsUpgrade libslirpUpgrade podman-dockerUpgrade podman-testsUpgrade podman-gvproxyUpgrade crunUpgrade conmonUpgrade fuse-overlayfsUpgrade golang-binUpgrade go-toolsetUpgrade podmanUpgrade golangUpgrade containers-commonUpgrade runcUpgrade criu-libsUpgrade grafanaUpgrade golang-testsUpgrade containernetworking-pluginsUpgrade buildahUpgrade podman-remoteUpgrade python3-criuUpgrade aardvark-dnsUpgrade udicaUpgrade libslirp-develUpgrade critUpgrade podman-catatonitUpgrade golang-srcUpgrade buildah-testsUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade golang-docs | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-googlecode-sqlite-develUpgrade golang-srcUpgrade golang-github-gorilla-context-develUpgrade golistUpgrade golangUpgrade golang-miscUpgrade golang-testsUpgrade golang-raceUpgrade golang-github-kr-pty-develUpgrade golang-binUpgrade go-srpm-macrosUpgrade go-rpm-macrosUpgrade golang-github-syndtr-gocapability-develUpgrade golang-googlecode-net-develUpgrade golang-github-gorilla-mux-develUpgrade runc-debuginfoUpgrade go-rpm-templatesUpgrade golist-debuginfoUpgrade runcUpgrade golang-sharedUpgrade golang-docsUpgrade go-filesystemUpgrade golang-github-godbus-dbus-devel | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-github-cpuguy83-md2manUpgrade golist-debuginfoUpgrade golistUpgrade golang-raceUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-sharedUpgrade golang-github-cpuguy83-md2man-develUpgrade golangUpgrade golang-testsUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-docsUpgrade golang-binUpgrade golist-debugsourceUpgrade golang-srcUpgrade golang-misc | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade go-toolsetUpgrade grafanaUpgrade delveUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade golangUpgrade slirp4netns-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade container-selinuxUpgrade criu-debugsourceUpgrade python3-podmanUpgrade aardvark-dnsUpgrade buildah-tests-debuginfoUpgrade crun-debuginfoUpgrade buildah-debugsourceUpgrade criu-libsUpgrade podman-catatonit-debuginfoUpgrade golang-raceUpgrade delve-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade golang-srcUpgrade podman-plugins-debuginfoUpgrade skopeo-testsUpgrade criu-debuginfoUpgrade runc-debuginfoUpgrade golang-miscUpgrade libslirp-develUpgrade golang-docsUpgrade podman-testsUpgrade runc-debugsourceUpgrade runcUpgrade conmonUpgrade python3-criuUpgrade podman-debuginfoUpgrade udicaUpgrade buildah-debuginfoUpgrade libslirp-debugsourceUpgrade libslirpUpgrade buildah-testsUpgrade podmanUpgrade critUpgrade toolbox-debugsourceUpgrade skopeoUpgrade podman-dockerUpgrade toolboxUpgrade netavarkUpgrade grafana-debuginfoUpgrade golang-binUpgrade criu-libs-debuginfoUpgrade conmon-debuginfoUpgrade toolbox-debuginfoUpgrade golang-testsUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade delve-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade podman-gvproxyUpgrade libslirp-debuginfoUpgrade conmon-debugsourceUpgrade podman-catatonitUpgrade skopeo-debuginfoUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade fuse-overlayfsUpgrade criuUpgrade crunUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade buildah | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go118Upgrade go117 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golang-binUpgrade golang | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade podman-testsUpgrade aardvark-dnsUpgrade conmonUpgrade python3-podmanUpgrade podman-gvproxyUpgrade go-toolsetUpgrade crunUpgrade cockpit-podmanUpgrade golang-raceUpgrade udicaUpgrade python3-criuUpgrade buildahUpgrade grafanaUpgrade libslirpUpgrade podman-dockerUpgrade container-selinuxUpgrade slirp4netnsUpgrade buildah-testsUpgrade libslirp-develUpgrade fuse-overlayfsUpgrade criuUpgrade podman-pluginsUpgrade golang-docsUpgrade podmanUpgrade critUpgrade golang-miscUpgrade golang-binUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade golang-srcUpgrade criu-develUpgrade containers-commonUpgrade skopeo-testsUpgrade criu-libsUpgrade podman-remoteUpgrade golangUpgrade skopeoUpgrade delveUpgrade golang-testsUpgrade netavarkUpgrade runc | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debuginfoUpgrade golang-miscUpgrade criuUpgrade netavarkUpgrade runc-debugsourceUpgrade podman-testsUpgrade podman-catatonitUpgrade skopeoUpgrade toolbox-testsUpgrade udicaUpgrade containernetworking-pluginsUpgrade python3-podmanUpgrade conmon-debugsourceUpgrade golang-docsUpgrade golang-testsUpgrade podmanUpgrade podman-debuginfoUpgrade podman-gvproxyUpgrade delve-debugsourceUpgrade conmon-debuginfoUpgrade grafana-debuginfoUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade skopeo-debugsourceUpgrade critUpgrade fuse-overlayfsUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade buildah-testsUpgrade podman-remoteUpgrade runcUpgrade cockpit-podmanUpgrade criu-debugsourceUpgrade conmonNo solution existsUpgrade golang-raceUpgrade golang-binUpgrade golangUpgrade toolbox-debugsourceUpgrade aardvark-dnsUpgrade criu-libs-debuginfoUpgrade buildahUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade toolbox-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade go-toolsetUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade container-selinuxUpgrade libslirpUpgrade criu-develUpgrade python3-criuUpgrade containers-commonUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libsUpgrade grafanaUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debugsourceUpgrade golang-srcUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade delveUpgrade buildah-debugsourceUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade libslirp-develUpgrade crun-debugsourceUpgrade crunUpgrade delve-debuginfoUpgrade podman-plugins-debuginfo | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade buildah-testsUpgrade podman-pluginsUpgrade podman-testsUpgrade conmon-debuginfoUpgrade golang-raceUpgrade buildahUpgrade conmonUpgrade delveUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-debuginfoUpgrade grafanaUpgrade toolbox-testsUpgrade go-toolsetUpgrade toolboxUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeo-debugsourceUpgrade crunUpgrade slirp4netnsUpgrade conmon-debugsourceUpgrade crun-debuginfoUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debugsourceUpgrade libslirp-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade criuUpgrade toolbox-debugsourceUpgrade fuse-overlayfsUpgrade criu-libsUpgrade python3-criuUpgrade grafana-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade delve-debugsourceUpgrade golang-binUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade skopeoUpgrade buildah-debugsourceUpgrade podman-catatonitUpgrade podman-remoteUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade criu-develUpgrade criu-debugsourceUpgrade containers-commonUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade buildah-debuginfoUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade skopeo-testsUpgrade fuse-overlayfs-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade slirp4netns-debuginfoUpgrade runc-debugsourceUpgrade toolbox-debuginfoUpgrade podmanUpgrade delve-debuginfoUpgrade crit | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17Upgrade go1.18-openssl-raceUpgrade go1.17-raceUpgrade go1.18-docUpgrade go1.18-openssl-docUpgrade go1.18-raceUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.17-doc | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.16-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.16Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.18-goUpgrade golang-1.13-goUpgrade golang-1.13Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub