CVE-2022-28131: Uncontrolled Recursion in encoding/xml Package in Bitnami Golang
Summary
CVE-2022-28131: Stack exhaustion from deeply nested XML documents in encoding/xml. Affects golang across 2 version ranges.
< 1.17.12
>= 1.18.0, < 1.18.4
Fixed in 1.17.12 or 1.18.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2022-28131 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bitnami Golang is an open-source programming language that provides a platform for building efficient and scalable applications. The encoding/xml package in Bitnami Golang is responsible for encoding and decoding XML data. This vulnerability, identified as CVE-2022-28131, allows an attacker to trigger uncontrolled recursion in the Decoder.Skip function, leading to a stack exhaustion and causing a panic. This vulnerability affects versions before Go 1.17.12 and Go 1.18.4.
Vulnerability Detail
The vulnerability arises due to a lack of proper recursion control in the Decoder.Skip function of the encoding/xml package. By crafting a deeply nested XML document, an attacker can exhaust the stack, resulting in a panic and potential denial of service. This vulnerability has a high severity rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and can be exploited remotely without authentication.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.17.121.17.12 -
>= 1.18.0, < 1.18.41.18.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can implement input validation to limit the depth of XML documents processed by the Decoder.Skip function. By setting a maximum depth threshold, the risk of stack exhaustion can be mitigated. Here's an example of how to implement this workaround in Go:
package main
import (
"encoding/xml"
"io"
"os"
)
func main() {
decoder := xml.NewDecoder(os.Stdin)
decoder.Strict = false
decoder.Entity = xml.HTMLEntity
decoder.MaxDepth = 100 // Set the maximum depth threshold
err := decoder.Decode(&struct{}{})
if err != nil && err != io.EOF {
panic(err)
}
}
Conclusion
In conclusion, the uncontrolled recursion vulnerability in the encoding/xml package of Bitnami Golang can lead to a denial of service condition. It is crucial to update the affected package to version 1.17.12 or 1.18.4 to mitigate this vulnerability. Implementing input validation to limit the depth of XML documents processed by the Decoder.Skip function can also provide temporary protection. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can be exploited by an attacker to cause a denial of service (DoS) by triggering a panic due to stack exhaustion. It can potentially disrupt the availability of affected applications.
No, authentication is not required to exploit this vulnerability. It can be exploited remotely.
Versions of Bitnami Golang before 1.17.12 and 1.18.4 are affected by this vulnerability.
Yes, updating the affected Bitnami Golang package to version 1.17.12 or 1.18.4 will mitigate this vulnerability. Additionally, implementing input validation to limit the depth of XML documents processed by the Decoder.Skip function can serve as a temporary workaround.
You can find more information about this vulnerability in the official Bitnami Golang vulnerability database: https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2022-28131.json
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
