CVE-2022-32149: Denial of service via crafted Accept-Language header in golang.org/x/text/language
First published: Tue Oct 11 2022(Updated: )
A vulnerability was found in golang.org/x/text/language package which could cause a denial of service. An attacker can craft an Accept-Language header which ParseAcceptLanguage will take significant time to parse. Version v0.3.8 of golang.org/x/text fixes a vulnerability. References: <a href="https://groups.google.com/g/golang-dev/c/qfPIly0X7aU">https://groups.google.com/g/golang-dev/c/qfPIly0X7aU</a>. <a href="https://go.dev/issue/56152">https://go.dev/issue/56152</a>. Upstream Commit: <a href="https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c">https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c</a>
Credit: security@golang.org security@golang.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/golang.org/x/text | <0.3.8 | 0.3.8 |
| redhat/podman | <3:4.2.0-7.rhaos4.12.el9 | 3:4.2.0-7.rhaos4.12.el9 |
| redhat/kubevirt | <0:4.13.0-1469.el7 | 0:4.13.0-1469.el7 |
| redhat/kubevirt | <0:4.13.0-1469.el8 | 0:4.13.0-1469.el8 |
| redhat/kubevirt | <0:4.13.0-1469.el9 | 0:4.13.0-1469.el9 |
| Golang Text | <0.3.8 | |
| redhat/golang.org/x/text | <0.3.8 | 0.3.8 |
| IBM Concert Software | <=1.0.0 - 1.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-32149
- https://go.dev/cl/442235
- https://go.dev/issue/56152
- https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ
- https://pkg.go.dev/vuln/GO-2022-1059
- https://github.com/golang/go/issues/56152
- https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c
- https://github.com/advisories/GHSA-69ch-w2m2-3vjp (Advisory)
- https://www.cve.org/CVERecord?id=CVE-2022-32149 https://nvd.nist.gov/vuln/detail/CVE-2022-32149 https://go.dev/issue/56152 https://groups.google.com/g/golang-dev/c/qfPIly0X7aU
- https://bugzilla.redhat.com/show_bug.cgi?id=2134010
- https://access.redhat.com/errata/RHSA-2022:7435
- https://access.redhat.com/errata/RHSA-2023:0692
- https://access.redhat.com/errata/RHSA-2023:1042
- https://access.redhat.com/errata/RHSA-2022:7407
- https://access.redhat.com/errata/RHSA-2022:6882
- https://access.redhat.com/errata/RHSA-2023:0481
- https://access.redhat.com/errata/RHSA-2023:0795
- https://access.redhat.com/errata/RHSA-2023:0693
- https://access.redhat.com/errata/RHSA-2023:3613
- https://access.redhat.com/errata/RHSA-2023:3204
- https://access.redhat.com/errata/RHSA-2023:3205
- https://access.redhat.com/errata/RHSA-2022:7434
- https://access.redhat.com/security/cve/cve-2022-32149
- https://groups.google.com/g/golang-dev/c/qfPIly0X7aU
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2217701
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2217702
- https://access.redhat.com/errata/RHSA-2024:1994
- https://access.redhat.com/errata/RHSA-2024:2077
- https://www.ibm.com/support/pages/node/7173596 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-32149?
CVE-2022-32149 is a vulnerability that allows an attacker to cause a denial of service (DoS) by crafting an Accept-Language header.
What is the severity of CVE-2022-32149?
CVE-2022-32149 has a severity rating of 7.5 (High).
Which software packages are affected by CVE-2022-32149?
The software packages affected by CVE-2022-32149 include golang.org/x/text, podman, and kubevirt.
How can an attacker exploit CVE-2022-32149?
An attacker can exploit CVE-2022-32149 by leveraging the quadratic time complexity of the BCP 47 tag parser to force a program to consume significant time parsing Accept-Language headers.
How can I fix CVE-2022-32149?
To fix CVE-2022-32149, it is recommended to update the affected software packages to the latest versions provided by the vendors.
- collector/github-advisory-latest
- alias/GHSA-69ch-w2m2-3vjp
- alias/CVE-2022-32149
- collector/github-advisory
- collector/redhat-cve
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/severity
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/references
- agent/title
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/ibm-support
- source/IBM
- package-manager/go
- package-manager/redhat
- vendor/golang
- canonical/golang text
- vendor/ibm
- canonical/ibm concert software
- version/ibm concert software/1.0.0 - 1.0.1