UBUNTU-CVE-2022-2879
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
02 / AFFECTED SOFTWARE
Affected packages
1 explicit affected versions
2 explicit affected versions
10 explicit affected versions
8 explicit affected versions
1 explicit affected versions
2 explicit affected versions
5 explicit affected versions
9 explicit affected versions
9 explicit affected versions
1 explicit affected versions
1 explicit affected versions
2 explicit affected versions
6 explicit affected versions
6 explicit affected versions
3 explicit affected versions
3 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
05 / REFERENCES
Further evidence
- https://github.com/golang/go/commit/0a723816cd205576945fa57fbdde7e6532d59d08
- https://github.com/golang/go/commit/4fa773cdefd20be093c84f731be7d4febf5536fa
- https://go.dev/issue/54853
- https://ubuntu.com/security/CVE-2022-2879
- https://ubuntu.com/security/notices/USN-6038-1
- https://ubuntu.com/security/notices/USN-6038-2
- https://www.cve.org/CVERecord?id=CVE-2022-2879