CVE-2024-34158: Stack exhaustion in Parse in go/build/constraint
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
Other sources
Golang Go is vulnerable to a denial of service, caused by a stack exhaustion in Parse. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-1.23to a version that resolves this vulnerability.Fixed in 1.23.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34158?
CVE-2024-34158 has been classified as a denial of service vulnerability due to potential stack exhaustion.
How do I fix CVE-2024-34158?
To mitigate CVE-2024-34158, upgrade affected versions of Golang to 1.22.11-1 or 1.23.5-1.
What products are affected by CVE-2024-34158?
CVE-2024-34158 affects IBM Concert Software versions up to 1.0.3 and specific Debian packages of Golang.
Can CVE-2024-34158 cause application crashes?
Yes, CVE-2024-34158 can cause application crashes due to stack exhaustion during parsing.
Is CVE-2024-34158 related to Golang?
Yes, CVE-2024-34158 specifically affects the Golang programming language when parsing certain build tag lines.