CVE-2022-1962

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
golanggo
𝑥
< 1.17.12
golanggo
1.18.0 ≤
𝑥
< 1.18.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-1.15
bullseye
vulnerable
buster
postponed
golang-1.19
bookworm
1.19.8-2
fixed
bullseye
no-dsa
buster
postponed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang-1.18
bionic
Fixed 1.18.1-1ubuntu1~18.04.4
released
focal
Fixed 1.18.1-1ubuntu1~20.04.2
released
impish
dne
jammy
Fixed 1.18.1-1ubuntu1.1
released
kinetic
dne
lunar
dne
trusty
dne
xenial
dne
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
go-toolset
RHEL 9
0:1.17.12-1.el9_0
fixed
golang
RHEL 9
0:1.17.12-1.el9_0
fixed
golang-bin
RHEL 9
0:1.17.12-1.el9_0
fixed
golang-docs
RHEL 9
0:1.17.12-1.el9_0
fixed
golang-misc
RHEL 9
0:1.17.12-1.el9_0
fixed
golang-race
RHEL 9
0:1.17.12-1.el9_0
fixed
golang-src
RHEL 9
0:1.17.12-1.el9_0
fixed
golang-tests
RHEL 9
0:1.17.12-1.el9_0
fixed
grafana
RHEL 9
0:7.5.15-3.el9
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
compat-golang-github-cpuguy83-md2man-2-devel
Amazon Linux 2023
0:2.0.2-22.amzn2023.0.2
fixed
go-filesystem
Amazon Linux 2
0:3.0.15-23.amzn2.0.2
fixed
go-rpm-macros
Amazon Linux 2
0:3.0.15-23.amzn2.0.2
fixed
go-rpm-templates
Amazon Linux 2
0:3.0.15-23.amzn2.0.2
fixed
go-srpm-macros
Amazon Linux 2
0:3.0.15-23.amzn2.0.2
fixed
golang
Amazon Linux 1
0:1.18.6-1.42.amzn1
fixed
Amazon Linux 2
0:1.18.5-1.amzn2
fixed
Amazon Linux 2023
0:1.19.3-2.amzn2023.0.2
fixed
golang-bin
Amazon Linux 1
0:1.18.6-1.42.amzn1
fixed
Amazon Linux 2
0:1.18.5-1.amzn2
fixed
Amazon Linux 2023
0:1.19.3-2.amzn2023.0.2
fixed
golang-docs
Amazon Linux 1
0:1.18.6-1.42.amzn1
fixed
Amazon Linux 2
0:1.18.5-1.amzn2
fixed
Amazon Linux 2023
0:1.19.3-2.amzn2023.0.2
fixed
golang-github-cpuguy83-md2man
Amazon Linux 2023
0:2.0.2-22.amzn2023.0.2
fixed
golang-github-cpuguy83-md2man-debuginfo
Amazon Linux 2023
0:2.0.2-22.amzn2023.0.2
fixed
golang-github-cpuguy83-md2man-debugsource
Amazon Linux 2023
0:2.0.2-22.amzn2023.0.2
fixed
golang-github-cpuguy83-md2man-devel
Amazon Linux 2023
0:2.0.2-22.amzn2023.0.2
fixed
golang-github-godbus-dbus-devel
Amazon Linux 2
0:0-0.1.gitcb98efb.amzn2.0.2
fixed
golang-github-gorilla-context-devel
Amazon Linux 2
0:0-0.24.gitb06ed15.amzn2.0.4
fixed
golang-github-gorilla-mux-devel
Amazon Linux 2
0:0-0.16.git136d54f.amzn2.0.2
fixed
golang-github-kr-pty-devel
Amazon Linux 2
0:0-0.19.git98c7b80.amzn2.0.3
fixed
golang-github-syndtr-gocapability-devel
Amazon Linux 2
0:0-0.5.git3454319.amzn2.0.3
fixed
golang-googlecode-net-devel
Amazon Linux 2
0:0-0.12.hg84a4013f96e0.amzn2.0.2
fixed
golang-googlecode-sqlite-devel
Amazon Linux 2
0:0-0.9.hg74691fb6f837.amzn2.0.4
fixed
golang-misc
Amazon Linux 1
0:1.18.6-1.42.amzn1
fixed
Amazon Linux 2
0:1.18.5-1.amzn2
fixed
Amazon Linux 2023
0:1.19.3-2.amzn2023.0.2
fixed
golang-race
Amazon Linux 1
0:1.18.6-1.42.amzn1
fixed
Amazon Linux 2
0:1.18.5-1.amzn2
fixed
Amazon Linux 2023
0:1.19.3-2.amzn2023.0.2
fixed
golang-shared
Amazon Linux 1
0:1.18.6-1.42.amzn1
fixed
Amazon Linux 2
0:1.18.5-1.amzn2
fixed
Amazon Linux 2023
0:1.19.3-2.amzn2023.0.2
fixed
golang-src
Amazon Linux 1
0:1.18.6-1.42.amzn1
fixed
Amazon Linux 2
0:1.18.5-1.amzn2
fixed
Amazon Linux 2023
0:1.19.3-2.amzn2023.0.2
fixed
golang-tests
Amazon Linux 1
0:1.18.6-1.42.amzn1
fixed
Amazon Linux 2
0:1.18.5-1.amzn2
fixed
Amazon Linux 2023
0:1.19.3-2.amzn2023.0.2
fixed
golist
Amazon Linux 2
0:0.10.1-10.amzn2.0.1
fixed
Amazon Linux 2023
0:0.10.1-11.amzn2023.0.3
fixed
golist-debuginfo
Amazon Linux 2
0:0.10.1-10.amzn2.0.1
fixed
Amazon Linux 2023
0:0.10.1-11.amzn2023.0.3
fixed
golist-debugsource
Amazon Linux 2023
0:0.10.1-11.amzn2023.0.3
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
golang
CBL-Mariner 1.0
0:1.18.5-1.cm1
fixed
CBL-Mariner 2.0
0:1.18.5-1.cm2
fixed
Common Weakness Enumeration
References
https://go.dev/cl/417063
https://go.dev/issue/53616
https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
https://pkg.go.dev/vuln/GO-2022-0515
https://go.dev/cl/417063
https://go.dev/issue/53616
https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
https://pkg.go.dev/vuln/GO-2022-0515