CVE-2023-24537: Infinite loop in parsing in go/scanner
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-1.19to a version that resolves this vulnerability.Fixed in 1.19.8-2 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.20.3 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.19.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.7-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.11-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.21.6-1
Event History
Frequently Asked Questions
What is the vulnerability ID?
CVE-2023-24537
What is the severity of CVE-2023-24537?
The severity of CVE-2023-24537 is high with a score of 7.5.
Which software packages are affected by CVE-2023-24537?
CVE-2023-24537 affects the following software packages: golang (version up to 1.19.8) and golang (version up to 1.20.3).
How can I fix CVE-2023-24537?
To fix CVE-2023-24537, update your golang package to version 1.19.8 or version 1.20.3 depending on your current version.
Are there any references related to CVE-2023-24537?
Yes, you can find more information about CVE-2023-24537 at the following references: [Link 1](https://go.dev/cl/482078), [Link 2](https://go.dev/issue/59180), [Link 3](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8).