CVE-2024-34158 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA-ADP	ADP	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 37%

Affected Products (NVD)

Vendor	Product	Version
go_build_constraint	go_standard_library	𝑥 < 1.22.7

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

golang-1.15

bookworm	no-dsa
bullseye	vulnerable

golang-1.19

bookworm	vulnerable
bullseye	postponed

Ubuntu Releases

Ubuntu Product

Codename

golang

focal	dne
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

golang-1.6

focal	dne
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne
xenial	needs-triage

golang-1.8

bionic	needs-triage
focal	dne
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

golang-1.9

bionic	needs-triage
focal	dne
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

golang-1.10

bionic	needs-triage
focal	dne
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne
trusty	needs-triage
xenial	needs-triage

golang-1.13

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	dne
oracular	dne
plucky	dne
questing	dne
xenial	needs-triage

golang-1.14

focal	needs-triage
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

golang-1.16

bionic	needs-triage
focal	needs-triage
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

golang-1.17

focal	dne
jammy	Fixed 1.17.13-3ubuntu1.3 released
noble	dne
oracular	dne
plucky	dne
questing	dne

golang-1.18

bionic	Fixed 1.18.1-1ubuntu1~18.04.4+esm1 released
focal	Fixed 1.18.1-1ubuntu1~20.04.3 released
jammy	Fixed 1.18.1-1ubuntu1.2 released
noble	dne
oracular	dne
plucky	dne
questing	dne
xenial	Fixed 1.18.1-1ubuntu1~16.04.6+esm1 released

golang-1.19

focal	dne
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

golang-1.20

focal	needs-triage
jammy	needs-triage
noble	dne
oracular	dne
plucky	dne
questing	dne

golang-1.21

focal	needs-triage
jammy	needs-triage
noble	needs-triage
oracular	dne
plucky	dne
questing	dne

golang-1.22

focal	Fixed 1.22.2-2~20.04.2 released
jammy	Fixed 1.22.2-2~22.04.2 released
noble	Fixed 1.22.2-2ubuntu0.3 released
oracular	not-affected
plucky	dne
questing	dne

Common Weakness Enumeration

CWE-674 - Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

https://go.dev/cl/611240

https://go.dev/issue/69141

https://groups.google.com/g/golang-dev/c/S9POB9NCTdk

https://pkg.go.dev/vuln/GO-2024-3107

https://security.netapp.com/advisory/ntap-20241004-0003/