CVE-2022-32189: Panic when decoding Float and Rat types in math/big
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
Other sources
A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
References: https://go.dev/issue/53871 https://groups.google.com/g/golang-nuts/c/DCFSyTGM0wU
Upstream Commits: Master : https://github.com/golang/go/commit/055113ef364337607e3e72ed7d48df67fde6fc66 Branch.go1.17 : https://github.com/golang/go/commit/703c8ab7e5ba75c95553d4e249309297abad7102 Branch.go1.18 : https://github.com/golang/go/commit/9240558e4f342fc6e98fec22de17c04b45089349
— Red Hat
An uncontrolled resource consumption flaw was found in Golang math/big. A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go, potentially allowing an attacker to create a denial of service, impacting availability.
Golang Go is vulnerable to a denial of service, caused by a flaw in Float.GobDecode and Rat GobDecode in math/big. By sending a specially-crafted message, a remote attacker could exploit this vulnerability to cause a panic.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2023:0584
- RHSA-2023:3642
- RHSA-2022:7129
- RHSA-2022:7548
- RHSA-2023:0446
- RHSA-2023:2758
- RHSA-2023:2802
- RHSA-2022:7950
- RHSA-2023:0328
- RHSA-2023:2193
- RHSA-2023:2236
- RHSA-2023:2357
- RHSA-2023:0693
- RHSA-2022:8534
- RHSA-2022:8535
- RHSA-2022:8626
- RHSA-2022:7398
- RHSA-2023:0542
- RHSA-2023:1275
- RHSA-2023:3204
- RHSA-2023:3205
- RHSA-2023:3742
- RHSA-2022:8781
- RHSA-2023:1529
- IBM-7173596
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-32189.
What is the severity of CVE-2022-32189?
CVE-2022-32189 has a severity of high.
Which software is affected by CVE-2022-32189?
CVE-2022-32189 affects Golang math/big.
How can CVE-2022-32189 be exploited?
CVE-2022-32189 can be exploited by sending a too-short encoded message, causing a panic in Float.GobDecode and Rat.GobDecode and potentially leading to a denial of service.
How can I fix CVE-2022-32189?
To fix CVE-2022-32189, update Golang to version 1.17.13 or 1.18.5, depending on the affected version.