CVE-2022-29526 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 83%

Affected Products (NVD)

Vendor	Product	Version
golang	go	𝑥 < 1.17.10
golang	go	1.18.0 ≤ 𝑥 < 1.18.2
netapp	beegfs_csi_driver	-

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

golang-1.15

bullseye

vulnerable

Ubuntu Releases

Ubuntu Product

Codename

golang

bionic	dne
focal	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

golang-1.10

bionic	needs-triage
focal	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	needs-triage
xenial	needs-triage

golang-1.13

bionic	not-affected
focal	not-affected
impish	ignored
jammy	not-affected
kinetic	ignored
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	not-affected

golang-1.14

bionic	dne
focal	needs-triage
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

golang-1.15

bionic	dne
focal	dne
impish	ignored
trusty	dne
xenial	dne

golang-1.16

bionic	Fixed 1.16.2-0ubuntu1~18.04.2+esm1 released
focal	Fixed 1.16.2-0ubuntu1~20.04.1 released
impish	ignored
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	ignored

golang-1.17

bionic	dne
focal	dne
impish	ignored
jammy	needs-triage
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	ignored

golang-1.18

bionic	Fixed 1.18.1-1ubuntu1~18.04.4 released
focal	Fixed 1.18.1-1ubuntu1~20.04.2 released
impish	dne
jammy	Fixed 1.18.1-1ubuntu1.1 released
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	Fixed 1.18.1-1ubuntu1~16.04.4 released

golang-1.6

bionic	dne
focal	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	needs-triage

golang-1.8

bionic	needs-triage
focal	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

golang-1.9

bionic	needs-triage
focal	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

Red Hat Enterprise Linux Releases

Red Hat Product

Release

go-toolset

RHEL 9

0:1.17.12-1.el9_0

fixed

golang

RHEL 9

0:1.17.12-1.el9_0

fixed

golang-bin

RHEL 9

0:1.17.12-1.el9_0

fixed

golang-docs

RHEL 9

0:1.17.12-1.el9_0

fixed

golang-misc

RHEL 9

0:1.17.12-1.el9_0

fixed

golang-race

RHEL 9

0:1.17.12-1.el9_0

fixed

golang-src

RHEL 9

0:1.17.12-1.el9_0

fixed

golang-tests

RHEL 9

0:1.17.12-1.el9_0

fixed

Amazon Linux Releases

Amazon Package

Release

compat-golang-github-cpuguy83-md2man-2-devel

Amazon Linux 2023

0:2.0.2-22.amzn2023.0.2

fixed

go-filesystem

Amazon Linux 2

0:3.0.15-23.amzn2.0.2

fixed

go-rpm-macros

Amazon Linux 2

0:3.0.15-23.amzn2.0.2

fixed

go-rpm-templates

Amazon Linux 2

0:3.0.15-23.amzn2.0.2

fixed

go-srpm-macros

Amazon Linux 2

0:3.0.15-23.amzn2.0.2

fixed

golang

Amazon Linux 1	0:1.18.6-1.42.amzn1 fixed
Amazon Linux 2	0:1.18.5-1.amzn2 fixed
Amazon Linux 2023	0:1.19.3-2.amzn2023.0.2 fixed

golang-bin

Amazon Linux 1	0:1.18.6-1.42.amzn1 fixed
Amazon Linux 2	0:1.18.5-1.amzn2 fixed
Amazon Linux 2023	0:1.19.3-2.amzn2023.0.2 fixed

golang-docs

Amazon Linux 1	0:1.18.6-1.42.amzn1 fixed
Amazon Linux 2	0:1.18.5-1.amzn2 fixed
Amazon Linux 2023	0:1.19.3-2.amzn2023.0.2 fixed

golang-github-cpuguy83-md2man

Amazon Linux 2023

0:2.0.2-22.amzn2023.0.2

fixed

golang-github-cpuguy83-md2man-debuginfo

Amazon Linux 2023

0:2.0.2-22.amzn2023.0.2

fixed

golang-github-cpuguy83-md2man-debugsource

Amazon Linux 2023

0:2.0.2-22.amzn2023.0.2

fixed

golang-github-cpuguy83-md2man-devel

Amazon Linux 2023

0:2.0.2-22.amzn2023.0.2

fixed

golang-github-godbus-dbus-devel

Amazon Linux 2

0:0-0.1.gitcb98efb.amzn2.0.2

fixed

golang-github-gorilla-context-devel

Amazon Linux 2

0:0-0.24.gitb06ed15.amzn2.0.4

fixed

golang-github-gorilla-mux-devel

Amazon Linux 2

0:0-0.16.git136d54f.amzn2.0.2

fixed

golang-github-kr-pty-devel

Amazon Linux 2

0:0-0.19.git98c7b80.amzn2.0.3

fixed

golang-github-syndtr-gocapability-devel

Amazon Linux 2

0:0-0.5.git3454319.amzn2.0.3

fixed

golang-googlecode-net-devel

Amazon Linux 2

0:0-0.12.hg84a4013f96e0.amzn2.0.2

fixed

golang-googlecode-sqlite-devel

Amazon Linux 2

0:0-0.9.hg74691fb6f837.amzn2.0.4

fixed

golang-misc

Amazon Linux 1	0:1.18.6-1.42.amzn1 fixed
Amazon Linux 2	0:1.18.5-1.amzn2 fixed
Amazon Linux 2023	0:1.19.3-2.amzn2023.0.2 fixed

golang-race

Amazon Linux 1	0:1.18.6-1.42.amzn1 fixed
Amazon Linux 2	0:1.18.5-1.amzn2 fixed
Amazon Linux 2023	0:1.19.3-2.amzn2023.0.2 fixed

golang-shared

Amazon Linux 1	0:1.18.6-1.42.amzn1 fixed
Amazon Linux 2	0:1.18.5-1.amzn2 fixed
Amazon Linux 2023	0:1.19.3-2.amzn2023.0.2 fixed

golang-src

Amazon Linux 1	0:1.18.6-1.42.amzn1 fixed
Amazon Linux 2	0:1.18.5-1.amzn2 fixed
Amazon Linux 2023	0:1.19.3-2.amzn2023.0.2 fixed

golang-tests

Amazon Linux 1	0:1.18.6-1.42.amzn1 fixed
Amazon Linux 2	0:1.18.5-1.amzn2 fixed
Amazon Linux 2023	0:1.19.3-2.amzn2023.0.2 fixed

golist

Amazon Linux 2	0:0.10.1-10.amzn2.0.1 fixed
Amazon Linux 2023	0:0.10.1-11.amzn2023.0.3 fixed

golist-debuginfo

Amazon Linux 2	0:0.10.1-10.amzn2.0.1 fixed
Amazon Linux 2023	0:0.10.1-11.amzn2023.0.3 fixed

golist-debugsource

Amazon Linux 2023

0:0.10.1-11.amzn2023.0.3

fixed

Azure Linux Releases

Azure Package

Release

buildah

Azure Linux 3.0

0:1.41.4-2.azl3

fixed

cni

Azure Linux 3.0

0:1.1.2-4.azl3

fixed

containernetworking-plugins

Azure Linux 3.0

0:1.6.1-4.azl3

fixed

cri-o

CBL-Mariner 2.0

0:1.21.7-2.cm2

fixed

golang

Azure Linux 3.0	0:1.22.7-2.azl3 fixed
CBL-Mariner 2.0	0:1.21.6-1.cm2 fixed

kured

CBL-Mariner 2.0

0:1.13.2-1.cm2

fixed

moby-engine

Azure Linux 3.0

0:25.0.3-1.azl3

fixed

multus

Azure Linux 3.0

0:4.0.2-1.azl3

fixed

nmi

CBL-Mariner 2.0

0:1.8.11-2.cm2

fixed

node-problem-detector

Azure Linux 3.0

0:0.8.15-1.azl3

fixed

podman

Azure Linux 3.0

0:5.6.1-2.azl3

fixed

prometheus

Azure Linux 3.0	0:2.37.0-1.azl3 fixed
CBL-Mariner 2.0	0:2.37.0-1.cm2 fixed

sriov-network-device-plugin

Azure Linux 3.0	0:3.7.0-1.azl3 fixed
CBL-Mariner 2.0	0:3.6.2-2.cm2 fixed

Known Exploits!

Common Weakness Enumeration

CWE-269 - Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References

https://github.com/golang/go/issues/52313

https://groups.google.com/g/golang-announce

https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/

https://security.gentoo.org/glsa/202208-02

https://security.netapp.com/advisory/ntap-20220729-0001/

https://github.com/golang/go/issues/52313

https://groups.google.com/g/golang-announce

https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/

https://security.gentoo.org/glsa/202208-02

https://security.netapp.com/advisory/ntap-20220729-0001/