CVE-2022-30631: Stack exhaustion when reading certain archives in compress/gzip
A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.
Other sources
Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.
— Red Hat
Golang Go is vulnerable to a denial of service, caused by an uncontrolled recursion flaw in Reader.Read in compress/gzip due to stack exhaustion. By parsing a specially-crafted compressed file, a remote attacker could exploit this vulnerability to cause a panic.
— IBM
Stack exhaustion when reading certain archives in compress/gzip
— Microsoft
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:6113
- RHSA-2022:6183
- RHSA-2022:6345
- RHSA-2022:6187
- RHSA-2022:6188
- RHSA-2022:6430
- RHSA-2022:6290
- RHSA-2023:1042
- RHSA-2022:6182
- RHSA-2022:6560
- RHSA-2022:6040
- RHSA-2022:6042
- RHSA-2022:6152
- RHSA-2022:6348
- RHSA-2022:6346
- RHSA-2022:6347
- RHSA-2022:6370
- RHSA-2023:3642
- RHSA-2022:5866
- RHSA-2022:5775
- RHSA-2022:7519
- RHSA-2022:7529
- RHSA-2022:7648
- RHSA-2023:2758
- RHSA-2023:2802
- RHSA-2022:5799
- RHSA-2022:8057
- RHSA-2022:8098
- RHSA-2022:8250
- RHSA-2022:6429
- RHSA-2022:5875
- RHSA-2022:6103
- RHSA-2022:7398
- RHSA-2022:6262
- RHSA-2022:6053
- RHSA-2022:6308
- RHSA-2022:5879
- RHSA-2022:6065
- RHSA-2022:6066
- RHSA-2022:6061
- RHSA-2022:6062
- RHSA-2022:6517
- RHSA-2022:6714
- RHSA-2023:0407
- RHSA-2023:0408
- RHSA-2022:6051
- RHSA-2022:6344
- RHSA-2022:6184
- RHSA-2022:5923
- RHSA-2022:5924
- RHSA-2023:1529
- IBM-7173596
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-30631.
What is the severity of CVE-2022-30631?
The severity of CVE-2022-30631 is high.
Which software versions are affected by CVE-2022-30631?
Versions before Go 1.17.12 and Go 1.18.4 are affected by CVE-2022-30631.
How can an attacker exploit CVE-2022-30631?
An attacker can exploit CVE-2022-30631 by causing a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
Where can I find more information about CVE-2022-30631?
You can find more information about CVE-2022-30631 at the following references: [CVE-2022-30631](https://www.cve.org/CVERecord?id=CVE-2022-30631), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-30631), [Go Issue Tracker](https://go.dev/issue/53168), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2107342), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:6113).