CVE-2022-24921: Input Validation
First published: Thu Mar 03 2022(Updated: )
Golang Go is vulnerable to a denial of service, caused by improper input validation. By using a specially-crafted deeply nested expression, a remote attacker could exploit this vulnerability to cause a goroutine stack exhaustion, and results in a denial of service condition.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openshift-serverless-clients | <0:1.3.1-4.el8 | 0:1.3.1-4.el8 |
| redhat/servicemesh | <0:2.1.5-1.el8 | 0:2.1.5-1.el8 |
| redhat/go-toolset | <1.17-golang-0:1.17.10-1.el7_9 | 1.17-golang-0:1.17.10-1.el7_9 |
| redhat/golang | <0:1.17.12-1.el9_0 | 0:1.17.12-1.el9_0 |
| redhat/go-toolset | <0:1.17.12-1.el9_0 | 0:1.17.12-1.el9_0 |
| redhat/cri-o | <0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7 | 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7 |
| redhat/cri-tools | <0:1.23.0-1.1.el8 | 0:1.23.0-1.1.el8 |
| redhat/butane | <0:0.15.0-1.rhaos4.11.el8 | 0:0.15.0-1.rhaos4.11.el8 |
| redhat/ignition | <0:2.14.0-3.rhaos4.11.el8 | 0:2.14.0-3.rhaos4.11.el8 |
| redhat/openshift-clients | <0:4.11.0-202207291716.p0.g7075089.assembly.stream.el8 | 0:4.11.0-202207291716.p0.g7075089.assembly.stream.el8 |
| redhat/kubevirt | <0:4.12.0-1057.el7 | 0:4.12.0-1057.el7 |
| redhat/kubevirt | <0:4.12.0-1057.el8 | 0:4.12.0-1057.el8 |
| Golang Go | <1.16.15 | |
| Golang Go | >=1.17<1.17.8 | |
| Netapp Astra Trident | ||
| Debian Debian Linux | =9.0 | |
| IBM Cloud Pak for Security | <=1.10.0.0 - 1.10.11.0 | |
| IBM QRadar Suite Software | <=1.10.12.0 - 1.10.16.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/221503
- https://www.ibm.com/support/pages/node/7080058 (Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
- https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
- https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html
- https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
- https://security.gentoo.org/glsa/202208-02
- https://security.netapp.com/advisory/ntap-20220325-0010/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2066512
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2066513
- https://access.redhat.com/errata/RHSA-2022:5415
- https://access.redhat.com/errata/RHSA-2022:5729
- https://access.redhat.com/errata/RHSA-2022:5730
- https://access.redhat.com/errata/RHSA-2022:5068
- https://access.redhat.com/errata/RHSA-2022:6042
- https://access.redhat.com/errata/RHSA-2022:6040
- https://access.redhat.com/errata/RHSA-2022:6156
- https://access.redhat.com/errata/RHSA-2022:6277
- https://access.redhat.com/errata/RHSA-2022:6526
- https://access.redhat.com/errata/RHSA-2022:6714
- https://access.redhat.com/errata/RHSA-2022:8750
- https://access.redhat.com/errata/RHSA-2023:0407
- https://access.redhat.com/security/cve/cve-2022-24921
- https://bugzilla.redhat.com/show_bug.cgi?id=2064857
- https://www.cve.org/CVERecord?id=CVE-2022-24921 https://nvd.nist.gov/vuln/detail/CVE-2022-24921 https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
- https://access.redhat.com/errata/RHSA-2022:5337
- https://access.redhat.com/errata/RHSA-2022:5799
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-24921?
CVE-2022-24921 is a vulnerability found in Golang's regexp module that can cause a stack overflow leading to a runtime crash.
How does CVE-2022-24921 impact the affected software?
CVE-2022-24921 can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps, potentially leading to denial of service.
Which versions of Golang are affected by CVE-2022-24921?
Golang versions before 1.16.15 and 1.17.x before 1.17.8 are affected by CVE-2022-24921.
What is the severity of CVE-2022-24921?
CVE-2022-24921 has a severity score of 7.5 (high).
How can I fix CVE-2022-24921?
To fix CVE-2022-24921, upgrade to Golang version 1.16.15 or 1.17.8, depending on the version you are using.
- collector/nvd-api
- collector/redhat-cve
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/weakness
- agent/references
- agent/severity
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-24921
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- collector/ibm-support
- source/IBM
- vendor/golang
- canonical/golang go
- version/golang go/1.17
- vendor/netapp
- canonical/netapp astra trident
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- package-manager/redhat
- vendor/ibm
- canonical/ibm cloud pak for security
- version/ibm cloud pak for security/1.10.0.0 - 1.10.11.0
- canonical/ibm qradar suite software
- version/ibm qradar suite software/1.10.12.0 - 1.10.16.0