Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade critUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade golang-binUpgrade containers-commonUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade golang-testsUpgrade golang-srcUpgrade buildahUpgrade libslirp-develUpgrade grafanaUpgrade podman-catatonitUpgrade runcUpgrade go-toolsetUpgrade podmanUpgrade golangUpgrade udicaUpgrade aardvark-dnsUpgrade podman-remoteUpgrade buildah-testsUpgrade golang-docsUpgrade python3-criuUpgrade netavarkUpgrade python3-podmanUpgrade crunUpgrade toolboxUpgrade podman-testsUpgrade libslirpUpgrade podman-gvproxyUpgrade golang-raceUpgrade skopeoUpgrade podman-dockerUpgrade podman-pluginsUpgrade criuUpgrade toolbox-testsUpgrade slirp4netnsUpgrade golang-miscUpgrade criu-develUpgrade conmonUpgrade delveUpgrade skopeo-testsUpgrade cockpit-podmanUpgrade fuse-overlayfs | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-binUpgrade golang-github-kr-pty-develUpgrade golangUpgrade golang-srcUpgrade golistUpgrade golang-googlecode-sqlite-develUpgrade go-srpm-macrosUpgrade golang-raceUpgrade golang-miscUpgrade golang-testsUpgrade golang-github-gorilla-context-develUpgrade golang-sharedUpgrade go-rpm-templatesUpgrade golist-debuginfoUpgrade runc-debuginfoUpgrade go-rpm-macrosUpgrade golang-docsUpgrade golang-github-godbus-dbus-develUpgrade go-filesystemUpgrade golang-github-syndtr-gocapability-develUpgrade runcUpgrade golang-googlecode-net-develUpgrade golang-github-gorilla-mux-devel | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-raceUpgrade golistUpgrade golang-github-cpuguy83-md2manUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golist-debuginfoUpgrade golangUpgrade golist-debugsourceUpgrade golang-srcUpgrade golang-github-cpuguy83-md2man-develUpgrade golang-miscUpgrade golang-binUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-docsUpgrade golang-tests | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade python3-podmanUpgrade delve-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade criu-libsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade grafanaUpgrade aardvark-dnsUpgrade criu-develUpgrade buildah-tests-debuginfoUpgrade slirp4netns-debugsourceUpgrade golang-raceUpgrade podman-remote-debuginfoUpgrade delveUpgrade criu-debuginfoUpgrade golang-miscUpgrade skopeo-testsUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade podman-catatonit-debuginfoUpgrade runc-debuginfoUpgrade container-selinuxUpgrade podman-plugins-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-pluginsUpgrade golang-srcUpgrade crun-debuginfoUpgrade crun-debugsourceUpgrade go-toolsetUpgrade golangUpgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade libslirpUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debuginfoUpgrade golang-docsUpgrade python3-criuUpgrade fuse-overlayfsUpgrade skopeo-debuginfoUpgrade containernetworking-pluginsUpgrade criuUpgrade podman-testsUpgrade toolboxUpgrade runc-debugsourceUpgrade runcUpgrade netavarkUpgrade golang-testsUpgrade golang-binUpgrade conmon-debuginfoUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade grafana-debuginfoUpgrade skopeo-debugsourceUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade slirp4netnsUpgrade conmonUpgrade podman-remoteUpgrade udicaUpgrade toolbox-debugsourceUpgrade critUpgrade podman-dockerUpgrade podmanUpgrade toolbox-debuginfoUpgrade skopeoUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade crunUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade delve-debugsourceUpgrade buildah | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go117Upgrade go118 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade conmonUpgrade container-selinuxUpgrade grafanaUpgrade slirp4netnsUpgrade python3-criuUpgrade crunUpgrade buildahUpgrade podman-dockerUpgrade podman-gvproxyUpgrade buildah-testsUpgrade cockpit-podmanUpgrade libslirpUpgrade python3-podmanUpgrade go-toolsetUpgrade udicaUpgrade golang-raceUpgrade podman-testsUpgrade aardvark-dnsUpgrade podmanUpgrade golangUpgrade delveUpgrade netavarkUpgrade criuUpgrade criu-libsUpgrade podman-remoteUpgrade libslirp-develUpgrade golang-docsUpgrade runcUpgrade golang-testsUpgrade golang-srcUpgrade criu-develUpgrade skopeo-testsUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade golang-binUpgrade critUpgrade golang-miscUpgrade fuse-overlayfsUpgrade containers-commonUpgrade podman-plugins | Aug 4, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade netavarkUpgrade buildah-testsUpgrade golang-miscUpgrade slirp4netnsUpgrade udicaUpgrade podman-dockerUpgrade conmonUpgrade buildah-tests-debuginfoUpgrade skopeoUpgrade containernetworking-pluginsUpgrade podman-testsUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debuginfoUpgrade criuUpgrade toolboxUpgrade delve-debugsourceUpgrade criu-debugsourceUpgrade podman-catatonitUpgrade criu-debuginfoUpgrade runcUpgrade aardvark-dnsUpgrade python3-podmanUpgrade podman-gvproxyUpgrade golang-binUpgrade skopeo-debuginfoUpgrade golang-raceUpgrade skopeo-debugsourceUpgrade runc-debugsourceUpgrade golang-docsUpgrade fuse-overlayfsUpgrade toolbox-debugsourceUpgrade cockpit-podmanUpgrade buildahUpgrade criu-libs-debuginfoUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade golangUpgrade libslirp-debuginfoNo solution existsUpgrade conmon-debugsourceUpgrade podmanUpgrade golang-testsUpgrade podman-debuginfoUpgrade podman-remoteUpgrade grafana-debuginfoUpgrade critUpgrade golang-srcUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade containers-commonUpgrade criu-libsUpgrade libslirp-develUpgrade go-toolsetUpgrade slirp4netns-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade crun-debugsourceUpgrade libslirpUpgrade python3-criuUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debuginfoUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade grafanaUpgrade delve-debuginfoUpgrade podman-plugins-debuginfoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade delveUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirp-debugsourceUpgrade crun-debuginfo | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade podman-pluginsUpgrade buildah-testsUpgrade go-toolsetUpgrade grafanaUpgrade conmon-debugsourceUpgrade crun-debuginfoUpgrade libslirpUpgrade skopeo-debugsourceUpgrade conmon-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golang-raceUpgrade toolbox-testsUpgrade buildahUpgrade delveUpgrade podman-testsUpgrade slirp4netnsUpgrade toolboxUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-debuginfoUpgrade crunUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade criu-debuginfoUpgrade containernetworking-pluginsUpgrade podmanUpgrade critUpgrade criu-debugsourceUpgrade criu-develUpgrade toolbox-debuginfoUpgrade crun-debugsourceUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade libslirp-debuginfoUpgrade golangUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debugsourceUpgrade skopeoUpgrade podman-debugsourceUpgrade grafana-debuginfoUpgrade criu-libsUpgrade python3-criuUpgrade fuse-overlayfsUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade golang-binUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade runc-debuginfoUpgrade toolbox-debugsourceUpgrade runc-debugsourceUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade criuUpgrade containers-commonUpgrade delve-debuginfoUpgrade buildah-tests-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade runc | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17-docUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.18-docUpgrade go1.18-openssl-docUpgrade go1.17-raceUpgrade go1.17Upgrade go1.18-openssl-raceUpgrade go1.18-race | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.13-goUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-srcUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.18-srcUpgrade golang-1.18-goUpgrade golang-1.18Upgrade golang-1.16Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-go (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub