CVE-2022-30631: Stack exhaustion when reading certain archives in compress/gzip
A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.
Other sources
Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.
— Red Hat
Golang Go is vulnerable to a denial of service, caused by an uncontrolled recursion flaw in Reader.Read in compress/gzip due to stack exhaustion. By parsing a specially-crafted compressed file, a remote attacker could exploit this vulnerability to cause a panic.
— IBM
Stack exhaustion when reading certain archives in compress/gzip
— Microsoft
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/skupper-clito a version that resolves this vulnerability.Fixed in 0:1.0.2-2.el8 - Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:1.3.1-4.el8 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-0:1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 0:7.5.15-3.el8 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:3.2.0-2.el8 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 0:1.17.12-1.el9_0 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 0:7.5.15-3.el9 - Upgrade
Upgrade
redhat/toolboxto a version that resolves this vulnerability.Fixed in 0:0.0.99.3-5.el9 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:3.2.0-3.el9 - Upgrade
Upgrade
redhat/butaneto a version that resolves this vulnerability.Fixed in 0:0.16.0-2.rhaos4.12.el8 - Upgrade
Upgrade
redhat/cri-oto a version that resolves this vulnerability.Fixed in 0:1.25.1-5.rhaos4.12.git6005903.el8 - Upgrade
Upgrade
redhat/cri-toolsto a version that resolves this vulnerability.Fixed in 0:1.25.0-2.el8 - Upgrade
Upgrade
redhat/ignitionto a version that resolves this vulnerability.Fixed in 0:2.14.0-5.rhaos4.12.el8 - Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 3:1.1.2-2.rhaos4.12.el8 - Upgrade
Upgrade
redhat/skopeoto a version that resolves this vulnerability.Fixed in 2:1.8.0-5.rhaos4.12.el9 - Upgrade
Upgrade
redhat/collectd-libpod-statsto a version that resolves this vulnerability.Fixed in 0:1.0.4-2.el8 - Upgrade
Upgrade
redhat/etcdto a version that resolves this vulnerability.Fixed in 0:3.3.23-10.el8 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.12.0-1057.el7 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.12.0-1057.el8 - Upgrade
Upgrade
debian/golang-1.19to a version that resolves this vulnerability.Fixed in 1.19.8-2 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.18.4 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.18.5-1 - Upgrade
Upgrade
golang compress/gzip (Reader.Read)to a version that resolves this vulnerability.Fixed in 1.17.12 - Upgrade
Upgrade
golang compress/gzip (Reader.Read)to a version that resolves this vulnerability.Fixed in 1.18.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:6113
- RHSA-2022:6183
- RHSA-2022:6345
- RHSA-2022:6187
- RHSA-2022:6188
- RHSA-2022:6430
- RHSA-2022:6290
- RHSA-2023:1042
- RHSA-2022:6182
- RHSA-2022:6560
- RHSA-2022:6040
- RHSA-2022:6042
- RHSA-2022:6152
- RHSA-2022:6348
- RHSA-2022:6346
- RHSA-2022:6347
- RHSA-2022:6370
- RHSA-2023:3642
- RHSA-2022:5866
- RHSA-2022:5775
- RHSA-2022:7519
- RHSA-2022:7529
- RHSA-2022:7648
- RHSA-2023:2758
- RHSA-2023:2802
- RHSA-2022:5799
- RHSA-2022:8057
- RHSA-2022:8098
- RHSA-2022:8250
- RHSA-2022:6429
- RHSA-2022:5875
- RHSA-2022:6103
- RHSA-2022:7398
- RHSA-2022:6262
- RHSA-2022:6053
- RHSA-2022:6308
- RHSA-2022:5879
- RHSA-2022:6065
- RHSA-2022:6066
- RHSA-2022:6061
- RHSA-2022:6062
- RHSA-2022:6517
- RHSA-2022:6714
- RHSA-2023:0407
- RHSA-2023:0408
- RHSA-2022:6051
- RHSA-2022:6344
- RHSA-2022:6184
- RHSA-2022:5923
- RHSA-2022:5924
- RHSA-2023:1529
- IBM-7173596
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-30631.
What is the severity of CVE-2022-30631?
The severity of CVE-2022-30631 is high.
Which software versions are affected by CVE-2022-30631?
Versions before Go 1.17.12 and Go 1.18.4 are affected by CVE-2022-30631.
How can an attacker exploit CVE-2022-30631?
An attacker can exploit CVE-2022-30631 by causing a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
Where can I find more information about CVE-2022-30631?
You can find more information about CVE-2022-30631 at the following references: [CVE-2022-30631](https://www.cve.org/CVERecord?id=CVE-2022-30631), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-30631), [Go Issue Tracker](https://go.dev/issue/53168), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2107342), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:6113).