CVE-2022-30632: Stack exhaustion on crafted paths in path/filepath
A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.
Other sources
Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.
— Red Hat
Golang Go is vulnerable to a denial of service, caused by an uncontrolled recursion flaw in Glob in path/filepath due to stack exhaustion. By sending a specially-crafted request using a path containing a large number of path separators, a remote attacker could exploit this vulnerability to cause a panic.
— IBM
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/skupper-clito a version that resolves this vulnerability.Fixed in 0:1.0.2-2.el8 - Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:1.3.1-4.el8 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-0:1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/git-lfsto a version that resolves this vulnerability.Fixed in 0:2.13.3-3.el8_6 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 0:7.5.15-3.el8 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:3.2.0-2.el8 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 0:1.17.12-1.el9_0 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 0:7.5.15-3.el9 - Upgrade
Upgrade
redhat/toolboxto a version that resolves this vulnerability.Fixed in 0:0.0.99.3-5.el9 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:3.2.0-3.el9 - Upgrade
Upgrade
redhat/git-lfsto a version that resolves this vulnerability.Fixed in 0:3.2.0-1.el9 - Upgrade
Upgrade
redhat/etcdto a version that resolves this vulnerability.Fixed in 0:3.3.23-12.el8 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.12.0-1057.el7 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.12.0-1057.el8 - Upgrade
Upgrade
debian/golang-1.19to a version that resolves this vulnerability.Fixed in 1.19.8-2 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.18.4 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.17.12 - Upgrade
Upgrade
golangto a version that resolves this vulnerability.Fixed in 1.17.12 - Upgrade
Upgrade
golangto a version that resolves this vulnerability.Fixed in 1.18.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:6113
- RHSA-2022:6345
- RHSA-2022:6188
- RHSA-2022:8634
- RHSA-2023:1042
- RHSA-2022:6040
- RHSA-2022:6042
- RHSA-2022:7058
- RHSA-2022:6152
- RHSA-2022:6348
- RHSA-2022:6346
- RHSA-2022:6347
- RHSA-2022:6370
- RHSA-2023:3642
- RHSA-2022:5866
- RHSA-2022:5775
- RHSA-2022:7129
- RHSA-2022:7519
- RHSA-2022:7529
- RHSA-2022:7648
- RHSA-2023:2758
- RHSA-2023:2802
- RHSA-2022:5799
- RHSA-2022:8057
- RHSA-2022:8098
- RHSA-2022:8250
- RHSA-2023:2357
- RHSA-2022:9047
- RHSA-2022:6283
- RHSA-2023:1275
- RHSA-2023:0407
- RHSA-2023:0408
- RHSA-2023:1529
- IBM-7173596
Frequently Asked Questions
What is CVE-2022-30632?
CVE-2022-30632 is a vulnerability that allows an attacker to cause a panic issue due to stack exhaustion by calling Glob on a path with a large number of path separators in golang.
How does CVE-2022-30632 impact availability?
CVE-2022-30632 can impact availability by causing a panic issue and exhausting the stack, potentially leading to a denial-of-service condition.
What is the severity of CVE-2022-30632?
CVE-2022-30632 has a severity rating of 7.5 (high).
How do I fix CVE-2022-30632?
To fix CVE-2022-30632, update to golang version 1.18.4 or 1.17.12, depending on the affected version.
Where can I find more information about CVE-2022-30632?
You can find more information about CVE-2022-30632 in the following references: [Bugzilla Red Hat - 2107387](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2107387), [Bugzilla Red Hat - 2110336](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2110336), [Red Hat Security Advisory - RHSA-2022:5775](https://access.redhat.com/errata/RHSA-2022:5775).