Google Go up to 1.17.12/1.18.4 math-big denial of service

Summaryinfo

A vulnerability has been found in Google Go up to 1.17.12/1.18.4 and classified as problematic. Affected is an unknown function of the component math-big. Performing a manipulation results in denial of service. This vulnerability is cataloged as CVE-2022-32189. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Google Go up to 1.17.12/1.18.4 (Programming Language Software). This affects an unknown part of the component math-big. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

The weakness was shared 08/11/2022. It is possible to read the advisory at go.dev. This vulnerability is uniquely identified as CVE-2022-32189 since 05/31/2022. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 240042 (TencentOS Server 3: git-lfs (TSSA-2023:0145)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.17.13 or 1.18.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (240042) and CERT Bund (WID-SEC-2022-2044). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Oracle Linux
• Red Hat OpenShift
• Gentoo Linux
• RESF Rocky Linux

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.17.4
• 1.17.5
• 1.17.6
• 1.17.7
• 1.17.8
• 1.17.9
• 1.17.10
• 1.17.11
• 1.17.12
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3
• 1.18.4

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion