CVE-2024-34158: Vulnerability in golang package - Stack Exhaustion
Summary
CVE-2024-34158: Stack exhaustion in Parse in go/build/constraint. Affects golang across 2 version ranges.
< 1.22.7
>= 1.23.0-0, < 1.23.1
Fixed in 1.22.7 or 1.23.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
- stdlib · Go
The same CVE-2024-34158 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package, developed by Bitnami, is an open-source programming language that is widely used for building scalable and efficient software applications. It provides a rich set of libraries and tools for developers to create robust applications. However, a vulnerability has been identified in the package that can lead to a stack exhaustion issue when calling Parse on a "// +build" build tag line with deeply nested expressions.
Vulnerability Detail
The vulnerability in the golang package arises from a flaw in the Parse function when handling deeply nested expressions in build tag lines. This flaw can cause a panic and lead to stack exhaustion, resulting in a denial of service condition. An attacker could potentially exploit this vulnerability to crash an application or cause it to become unresponsive. The severity of this vulnerability is rated as high.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.22.71.22.7 -
>= 1.23.0-0, < 1.23.11.23.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the golang package to the fixed version to address the issue effectively.
Conclusion
The golang package is susceptible to a stack exhaustion vulnerability when handling deeply nested expressions in build tag lines. This flaw can lead to a denial of service condition, potentially crashing the affected application. It is crucial for developers to update the golang package to version 1.23.1 or later to address this vulnerability and ensure the security and stability of their applications.
See every vulnerability recorded for golang →
FAQ
This vulnerability can lead to a denial of service condition, causing the affected application to crash or become unresponsive.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will alert you in real-time if your application is vulnerable.
Yes, a patch is available for this vulnerability. It is recommended to update the golang package to version 1.23.1 or later to fix the issue.
There are no known exploits for this vulnerability at the moment. However, it is crucial to update the golang package to the fixed version to prevent potential exploitation.
No, there is no known workaround for this vulnerability. It is necessary to update the golang package to the fixed version to mitigate the risk effectively.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
