CVE-2022-28131: stdlib - Stack Exhaustion in Decoder.Skip
Summary
CVE-2022-28131: Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. Affects golang-1.15 versions < 1ed3c127daceaffb9aadc806ba60f0b51b47421b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a standard library in the Go programming language. It provides a set of essential functions and types for various common tasks. The package includes encoding/xml, which allows encoding and decoding of XML data. However, versions before Go 1.17.12 and Go 1.18.4 are vulnerable to a stack exhaustion issue in the Decoder.Skip function.
Vulnerability Detail
The vulnerability, identified as CVE-2022-28131, stems from uncontrolled recursion in the Decoder.Skip function of encoding/xml. An attacker can exploit this vulnerability by providing a deeply nested XML document, causing a panic due to stack exhaustion. This can lead to a denial-of-service (DoS) scenario, rendering the affected application unresponsive. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the stdlib package to the fixed versions as soon as possible.
Conclusion
In conclusion, the stdlib package in Go versions before 1.17.12 and 1.18.4 is vulnerable to a stack exhaustion issue in the Decoder.Skip function. This can be exploited by providing a deeply nested XML document, leading to a denial-of-service scenario. To mitigate this vulnerability, it is crucial to update the stdlib package to the fixed versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can lead to a denial-of-service (DoS) scenario, causing the affected application to become unresponsive.
Versions before Go 1.17.12 and Go 1.18.4 are vulnerable to this issue.
There is no known public exploit for this vulnerability at the moment.
Updating the stdlib package to version 1.17.12 or 1.18.4 will mitigate this vulnerability.
Yes, it is recommended to update all applications using the stdlib package to the fixed versions to ensure they are not vulnerable.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
