CVE-2022-30633: Uncontrolled Recursion in encoding/xml in golang
Summary
CVE-2022-30633: Stack exhaustion when unmarshaling certain documents in encoding/xml. Affects golang across 2 version ranges.
< 1.17.12
>= 1.18.0, < 1.18.4
Fixed in 1.17.12 or 1.18.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2022-30633 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that is widely used for building efficient and reliable software applications. It provides a rich set of libraries and tools for various purposes, including XML parsing and encoding. The encoding/xml package in golang allows developers to marshal and unmarshal XML data into Go structs. However, a vulnerability has been discovered in versions before Go 1.17.12 and Go 1.18.4 that can lead to uncontrolled recursion in the Unmarshal function. This vulnerability can be exploited by an attacker to cause a panic due to stack exhaustion by unmarshalling an XML document into a Go struct with a nested field using the 'any' field tag.
Vulnerability Detail
The vulnerability (CVE-2022-30633) in the encoding/xml package of golang arises from uncontrolled recursion in the Unmarshal function. When unmarshalling an XML document into a Go struct that contains a nested field with the 'any' field tag, the recursion can lead to stack exhaustion and cause a panic. This can be exploited by an attacker to disrupt the normal execution of the application, potentially leading to denial of service or other unintended consequences. It is important to note that this vulnerability affects versions of golang before Go 1.17.12 and Go 1.18.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.17.121.17.12 -
>= 1.18.0, < 1.18.41.18.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can consider avoiding the use of the 'any' field tag in nested fields when unmarshalling XML documents into Go structs. Instead, they can use more specific field tags or alternative approaches to handle the XML data. Here is an example of how to modify the affected code:
Before:
type MyStruct struct {
NestedField interface{} `xml:"any"`
}
After:
type MyStruct struct {
NestedField SpecificType `xml:"specific"`
}
Conclusion
In conclusion, the uncontrolled recursion vulnerability in the encoding/xml package of golang can be exploited to cause a panic due to stack exhaustion. It is crucial for developers using affected versions of the golang package to update to the patched versions (1.17.12 or 1.18.4) to mitigate the risk. Additionally, modifying the code to avoid using the 'any' field tag in nested fields can serve as a temporary workaround. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can be exploited by an attacker to cause a panic due to stack exhaustion in applications using the affected versions of the golang package. This can lead to denial of service or other unintended consequences.
No, only versions before Go 1.17.12 and Go 1.18.4 are affected by this vulnerability. It is recommended to update to the latest patched versions to mitigate the risk.
Yes, developers can modify their code to avoid using the 'any' field tag in nested fields when unmarshalling XML documents into Go structs. More specific field tags or alternative approaches can be used instead.
To update your golang installation, you can follow the official documentation and guidelines provided by the golang community. They provide instructions on how to upgrade to the latest patched versions.
You can find more information about this vulnerability, including the CVE identifier (CVE-2022-30633), in the official vulnerability database and the golang community's security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
