CVE-2022-30631: Vulnerability in stdlib package - stack exhaustion in Reader.Read
Summary
CVE-2022-30631: Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compres... Affects golang-1.15 versions < 1ed3c127daceaffb9aadc806ba60f0b51b47421b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language standard library. It provides a collection of packages that offer essential functionality for Go programs. The package in question, compress/gzip, is responsible for reading and writing gzip-compressed files. It is widely used for data compression and decompression in various applications.
Vulnerability Detail
The vulnerability, identified as CVE-2022-30631, exists in the Reader.Read function of the compress/gzip package before versions 1.17.12 and 1.18.4. It arises due to uncontrolled recursion, which can be triggered by an attacker through an archive containing a large number of concatenated 0-length compressed files. This can lead to a panic and stack exhaustion, potentially causing a denial-of-service (DoS) condition. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can consider implementing input validation to prevent the processing of malicious archives with a large number of concatenated 0-length compressed files. However, applying the official fix by updating the stdlib package is the recommended approach.
Conclusion
The vulnerability in the stdlib package's compress/gzip module can be mitigated by updating to versions 1.17.12 or 1.18.4. Developers should prioritize applying the official fix to prevent potential denial-of-service (DoS) conditions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can be exploited to cause a panic and stack exhaustion, potentially leading to a denial-of-service (DoS) condition in applications utilizing the compress/gzip package.
Versions before 1.17.12 and 1.18.4 of the compress/gzip package are vulnerable to this issue.
At the time of this report, there is no known public exploit available for this vulnerability.
Updating the stdlib package to versions 1.17.12 or 1.18.4 is the recommended mitigation. Additionally, implementing input validation can help mitigate the risk of processing malicious archives.
There is no evidence of active exploitation of this vulnerability at the time of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
