CVE-2022-32189: Vulnerability in stdlib package - Denial of Service
Summary
CVE-2022-32189: A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. Affects golang-1.15 versions < 15da892a4950a4caac987ee72c632436329f62d5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The stdlib package is a part of the Go programming language and provides a collection of standard libraries for various functionalities. It includes the math/big package, which offers arbitrary-precision arithmetic operations on large numbers. This vulnerability affects versions 1.18.2 and prior of the stdlib package.
Vulnerability Detail
A vulnerability exists in the math/big package of the stdlib package in Go versions before 1.17.13 and 1.18.5. When decoding big.Float and big.Rat types from an encoded message, if the message is too short, it can trigger a panic. This vulnerability can be exploited to cause a denial of service (DoS) attack.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the stdlib package to the fixed versions mentioned above.
Conclusion
The stdlib package in Go versions before 1.17.13 and 1.18.5 is vulnerable to a denial of service (DoS) attack. It is crucial for developers to update their applications to use the fixed versions of the stdlib package to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
This vulnerability can lead to a denial of service (DoS) attack, potentially causing the affected application to crash or become unresponsive.
Versions 1.18.2 and prior of the stdlib package are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
