CVE-2022-1962: stdlib - Uncontrolled Recursion in Parse Functions
Summary
CVE-2022-1962: Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. Affects golang-1.15 versions < 1ed3c127daceaffb9aadc806ba60f0b51b47421b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a standard library in the Go programming language. It provides essential functions, types, and utilities for various tasks. The package is widely used in Go applications and is a fundamental component of the language's ecosystem. However, versions before 1.17.12 and 1.18.4 are vulnerable to uncontrolled recursion in the Parse functions of the go/parser module.
Vulnerability Detail
The vulnerability in the stdlib package arises from uncontrolled recursion in the Parse functions of the go/parser module. This flaw allows an attacker to trigger a panic due to stack exhaustion by utilizing deeply nested types or declarations. The impact of this vulnerability can lead to denial of service (DoS) attacks or the crashing of Go applications. It is important to note that this vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to update the package to the fixed versions as mentioned above.
Conclusion
The stdlib package in Go versions before 1.17.12 and 1.18.4 is vulnerable to uncontrolled recursion in the Parse functions. This can result in denial of service (DoS) attacks or application crashes. To address this issue, it is crucial to update the package to the fixed versions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can lead to denial of service (DoS) attacks or the crashing of Go applications.
Versions before 1.17.12 and 1.18.4 are vulnerable to this issue.
Yes, the CVSS score for this vulnerability is 5.5, indicating a medium severity level.
No known exploits have been reported for this vulnerability at the moment.
It is strongly recommended to update the package to version 1.17.12 or 1.18.4 to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
