Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade podmanUpgrade critUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade go-toolsetUpgrade libslirp-develUpgrade python3-criuUpgrade runcUpgrade criu-libsUpgrade containers-commonUpgrade golang-binUpgrade grafanaUpgrade container-selinuxUpgrade udicaUpgrade golang-testsUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade buildahUpgrade golang-srcUpgrade buildah-testsUpgrade golang-docsUpgrade slirp4netnsUpgrade crunUpgrade libslirpUpgrade podman-testsUpgrade netavarkUpgrade criuUpgrade delveUpgrade golang-raceUpgrade toolboxUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade criu-develUpgrade golang-miscUpgrade cockpit-podmanUpgrade skopeoUpgrade skopeo-testsUpgrade toolbox-testsUpgrade podman-pluginsUpgrade podman-dockerUpgrade podman-gvproxyUpgrade conmon | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golangUpgrade golistUpgrade golang-github-gorilla-context-develUpgrade golang-srcUpgrade go-srpm-macrosUpgrade golang-raceUpgrade golang-binUpgrade golang-github-kr-pty-develUpgrade golang-googlecode-sqlite-develUpgrade golang-testsUpgrade golang-docsUpgrade runc-debuginfoUpgrade go-rpm-templatesUpgrade golang-github-gorilla-mux-develUpgrade golang-googlecode-net-develUpgrade golang-sharedUpgrade runcUpgrade go-filesystemUpgrade golist-debuginfoUpgrade go-rpm-macrosUpgrade golang-github-syndtr-gocapability-develUpgrade golang-github-godbus-dbus-devel | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golist-debuginfoUpgrade golang-raceUpgrade golang-sharedUpgrade golang-github-cpuguy83-md2manUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golistUpgrade golang-miscUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golist-debugsourceUpgrade golangUpgrade golang-docsUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-binUpgrade golang-srcUpgrade golang-testsUpgrade golang-github-cpuguy83-md2man-devel | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade delve-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade crunUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade toolbox-testsUpgrade conmon-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade containernetworking-plugins-debugsourceUpgrade grafana-debuginfoUpgrade netavarkUpgrade podman-catatonitUpgrade buildah-debuginfoUpgrade cockpit-podmanUpgrade toolboxUpgrade criu-libs-debuginfoUpgrade udicaUpgrade conmonUpgrade runc-debugsourceUpgrade golang-binUpgrade skopeo-debugsourceUpgrade golang-docsUpgrade toolbox-debuginfoUpgrade podman-testsUpgrade python3-criuUpgrade golang-testsUpgrade podman-debuginfoUpgrade buildah-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debugsourceUpgrade libslirpUpgrade skopeo-debuginfoUpgrade fuse-overlayfsUpgrade libslirp-debugsourceUpgrade podmanUpgrade critUpgrade containernetworking-pluginsUpgrade criuUpgrade podman-remoteUpgrade podman-dockerUpgrade skopeoUpgrade libslirp-debuginfoUpgrade podman-gvproxyUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criu-debuginfoUpgrade container-selinuxUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade podman-debugsourceUpgrade delve-debuginfoUpgrade python3-podmanUpgrade podman-catatonit-debuginfoUpgrade containers-commonUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade golang-miscUpgrade golangUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade criu-debugsourceUpgrade golang-srcUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade golang-raceUpgrade criu-libsUpgrade buildah-debugsourceUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade grafanaUpgrade go-toolsetUpgrade criu-develUpgrade libslirp-devel | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go117Upgrade go118 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade podman-catatonitUpgrade skopeoUpgrade golang-testsUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade golang-docsUpgrade libslirp-develUpgrade podmanUpgrade runcUpgrade golang-binUpgrade golang-miscUpgrade critUpgrade fuse-overlayfsUpgrade netavarkUpgrade delveUpgrade containernetworking-pluginsUpgrade criu-develUpgrade golangUpgrade skopeo-testsUpgrade golang-srcUpgrade podman-remoteUpgrade containers-commonUpgrade criu-libsUpgrade criuUpgrade golang-raceUpgrade buildah-testsUpgrade python3-podmanUpgrade go-toolsetUpgrade udicaUpgrade cockpit-podmanUpgrade podman-testsUpgrade python3-criuUpgrade libslirpUpgrade buildahUpgrade slirp4netnsUpgrade crunUpgrade container-selinuxUpgrade conmonUpgrade podman-dockerUpgrade grafanaUpgrade podman-gvproxyUpgrade aardvark-dns | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade golang-testsUpgrade libslirp-debuginfoUpgrade podman-remoteUpgrade criu-debuginfoUpgrade skopeo-debuginfoUpgrade conmon-debuginfoUpgrade runcUpgrade podman-debuginfoUpgrade conmon-debugsourceUpgrade aardvark-dnsUpgrade grafana-debuginfoUpgrade golangUpgrade podman-gvproxyUpgrade skopeo-debugsourceUpgrade toolboxUpgrade podmanUpgrade buildah-debuginfoUpgrade toolbox-debugsourceNo solution existsUpgrade python3-podmanUpgrade buildahUpgrade golang-raceUpgrade critUpgrade golang-miscUpgrade netavarkUpgrade podman-dockerUpgrade udicaUpgrade golang-docsUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade podman-catatonitUpgrade criuUpgrade skopeoUpgrade delve-debugsourceUpgrade criu-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-testsUpgrade slirp4netnsUpgrade conmonUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade runc-debugsourceUpgrade buildah-tests-debuginfoUpgrade golang-binUpgrade golang-srcUpgrade slirp4netns-debugsourceUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade delveUpgrade buildah-debugsourceUpgrade libslirpUpgrade criu-develUpgrade python3-criuUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade container-selinuxUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfoUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade grafanaUpgrade criu-libsUpgrade containers-commonUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade libslirp-debugsourceUpgrade go-toolsetUpgrade podman-debugsourceUpgrade libslirp-develUpgrade delve-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade crun | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade skopeo-debuginfoUpgrade conmon-debuginfoUpgrade grafanaUpgrade podman-testsUpgrade podman-pluginsUpgrade buildah-testsUpgrade slirp4netnsUpgrade toolboxUpgrade containernetworking-plugins-debugsourceUpgrade golang-raceUpgrade buildahUpgrade libslirpUpgrade skopeo-debugsourceUpgrade crunUpgrade crun-debuginfoUpgrade conmonUpgrade delveUpgrade go-toolsetUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-testsUpgrade conmon-debugsourceUpgrade podman-debuginfoUpgrade containers-commonUpgrade criu-libs-debuginfoUpgrade criu-debugsourceUpgrade podman-catatonitUpgrade delve-debugsourceUpgrade podman-plugins-debuginfoUpgrade buildah-debugsourceUpgrade skopeoUpgrade libslirp-debuginfoUpgrade golangUpgrade criu-develUpgrade podman-remoteUpgrade criuUpgrade skopeo-testsUpgrade criu-debuginfoUpgrade podman-remote-debuginfoUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade runc-debugsourceUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debugsourceUpgrade criu-libsUpgrade grafana-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfsUpgrade python3-criuUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade podmanUpgrade crun-debugsourceUpgrade critUpgrade toolbox-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade runcUpgrade delve-debuginfoUpgrade golang-binUpgrade oci-seccomp-bpf-hook | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17-docUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.18-docUpgrade go1.18-raceUpgrade go1.17-raceUpgrade go1.18-openssl-docUpgrade go1.18-openssl-raceUpgrade go1.17 | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.18Upgrade golang-1.18-goUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.16-srcUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13Upgrade golang-1.13-go | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub