CVE-2022-30635 - Stack exhaustion when decoding certain messages in encoding/gob

Back Back to CVE browser

HIGH

Stack exhaustion when decoding certain messages in encoding/gob

Published Aug 9, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.81%

Description

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Affected products

Vendor Go standard library Product Encoding/gob Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.17.12
- Version
  1.18.0-0
  Status
  affected
  Constraints
  <1.18.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Go standard library

Encoding/gob

unaffected

Version	Status	Constraints
0	affected	<1.17.12
1.18.0-0	affected	<1.18.4

OADP-1.1-RHEL-8

oadp/oadp-velero-rhel8:1.1.1-20

Fixed · RHSA-2022:8634
OSSO-1.1-RHEL-8

openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8:v1.1-11

Fixed · RHSA-2022:6152
OpenShift Custom Metrics Autoscaler 2

custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8:2.8.2-143

Fixed · RHSA-2023:1042
Openshift Serveless 1.24

openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8:1.3.2-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8:1.3.2-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1-tech-preview/eventing-kafka-broker-webhook-rhel8:1.3.2-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/client-kn-rhel8:1.3.1-4

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-controller-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.3.2-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.3.2-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.3.2-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-mtping-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-storage-version-migration-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-sugar-controller-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/eventing-webhook-rhel8:1.3.2-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/ingress-rhel8-operator:1.24.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/kn-cli-artifacts-rhel8:1.3.1-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/knative-rhel8-operator:1.24.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/kourier-control-rhel8:1.3.0-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/net-istio-controller-rhel8:1.3.0-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/net-istio-webhook-rhel8:1.3.0-2

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serverless-operator-bundle:1.24.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serverless-rhel8-operator:1.24.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-activator-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-autoscaler-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-controller-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-domain-mapping-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-queue-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-storage-version-migration-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/serving-webhook-rhel8:1.3.0-3

Fixed · RHSA-2022:6040
Openshift Serveless 1.24

openshift-serverless-1/svls-must-gather-rhel8:1.24.0-2

Fixed · RHSA-2022:6040
Openshift Serverless 1 on RHEL 8

openshift-serverless-clients-0:1.3.1-4.el8

Fixed · RHSA-2022:6042
RHEL-7-CNV-4.12

kubevirt-0:4.12.0-1057.el7

Fixed · RHSA-2023:0407
RHEL-8-CNV-4.12

container-native-virtualization/virt-api:v4.12.0-255

Fixed · RHSA-2023:0408
RHEL-8-CNV-4.12

kubevirt-0:4.12.0-1057.el8

Fixed · RHSA-2023:0407
RHODF-4.13-RHEL-9

odf4/mcg-rhel9-operator:v4.13.0-41

Fixed · RHSA-2023:3742
Red Hat Ceph Storage 6.1

rhceph/rhceph-6-dashboard-rhel9:6-75

Fixed · RHSA-2023:3642
Red Hat Developer Tools

go-toolset-1.17-golang-0:1.17.12-1.el7_9

Fixed · RHSA-2022:5866
Red Hat Enterprise Linux 8

container-tools:4.0-8080020230217080101.8108cfbc

Fixed · RHSA-2023:2802
Red Hat Enterprise Linux 8

container-tools:rhel8-8080020230321153727.0f77c1b7

Fixed · RHSA-2023:2758
Red Hat Enterprise Linux 8

git-lfs-0:2.13.3-3.el8_6

Fixed · RHSA-2022:7129
Red Hat Enterprise Linux 8

go-toolset:rhel8-8060020220720230014.97d7f71f

Fixed · RHSA-2022:5775
Red Hat Enterprise Linux 8

grafana-0:7.5.15-3.el8

Fixed · RHSA-2022:7519
Red Hat Enterprise Linux 8

grafana-pcp-0:3.2.0-2.el8

Fixed · RHSA-2022:7648
Red Hat Enterprise Linux 9

git-lfs-0:3.2.0-1.el9

Fixed · RHSA-2023:2357
Red Hat Enterprise Linux 9

golang-0:1.17.12-1.el9_0

Fixed · RHSA-2022:5799
Red Hat Enterprise Linux 9

grafana-0:7.5.15-3.el9

Fixed · RHSA-2022:8057
Red Hat Enterprise Linux 9

grafana-pcp-0:3.2.0-3.el9

Fixed · RHSA-2022:8250
Red Hat Migration Toolkit for Containers 1.7

rhmtc/openshift-velero-plugin-rhel8:v1.7.6-5

Fixed · RHSA-2022:9047
Red Hat OpenShift Service Mesh 2.2 for RHEL 8

openshift-service-mesh/istio-cni-rhel8:2.2.2-7

Fixed · RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8

openshift-service-mesh/istio-rhel8-operator:2.2.2-8

Fixed · RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8

openshift-service-mesh/pilot-rhel8:2.2.2-7

Fixed · RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8

openshift-service-mesh/prometheus-rhel8:2.2.2-4

Fixed · RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8

openshift-service-mesh/proxyv2-rhel8:2.2.2-8

Fixed · RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8

openshift-service-mesh/ratelimit-rhel8:2.2.2-4

Fixed · RHSA-2022:6283
Red Hat OpenStack Platform 16.1

etcd-0:3.3.23-12.el8ost

Fixed · RHSA-2023:1275
Red Hat OpenStack Platform 16.2

etcd-0:3.3.23-12.el8ost

Fixed · RHSA-2023:1275
Migration Toolkit for Virtualization

migration-toolkit-virtualization/mtv-controller-rhel9

Affected
OpenShift Developer Tools and Services

odo

Affected
OpenShift Pipelines

openshift-pipelines-client

Affected
Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/gatekeeper-rhel8-operator

Affected
Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/subctl-rhel9

Affected
Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/volsync-rhel9

Affected
Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/work-rhel8

Affected
Red Hat Advanced Cluster Security 3

advanced-cluster-security/rhacs-main-rhel8

Affected
Red Hat Ansible Automation Platform 2

openshift-clients

Affected
Red Hat Ceph Storage 3

golang

Out of support scope
Red Hat Ceph Storage 5

rhceph/rhceph-5-dashboard-rhel8

Affected
Red Hat Enterprise Linux 8

container-tools:3.0/containernetworking-plugins

Affected
Red Hat Enterprise Linux 8

osbuild-composer

Will not fix
Red Hat Enterprise Linux 9

containernetworking-plugins

Will not fix
Red Hat Enterprise Linux 9

go-toolset

Affected
Red Hat Enterprise Linux 9

osbuild-composer

Will not fix
Red Hat OpenShift Container Platform 4

openshift-golang-builder-container

Not affected
Red Hat OpenShift GitOps

openshift-gitops-1/gitops-rhel8

Affected
Red Hat OpenShift GitOps

openshift-gitops-kam

Affected
Red Hat OpenShift distributed tracing 2

rhosdt/jaeger-agent-rhel8

Not affected
Red Hat OpenStack Platform 16.2

rhosp-rhel8-tech-preview/osp-director-operator

Will not fix
Red Hat Openshift Data Foundation 4

mcg

Affected
Red Hat Openshift Data Foundation 4

odf4/cephcsi-rhel9

Affected
Red Hat Quay 3

quay/clair-rhel8

Affected
Red Hat Software Collections

rh-git227-git-lfs

Will not fix
Red Hat Storage 3

go-toolset-7-golang

Will not fix
Red Hat Storage 3

golang

Will not fix
Red Hat Storage 3

heketi

Out of support scope
Red Hat Web Terminal

web-terminal-exec-container

Affected

Product	Package	State	Advisory
OADP-1.1-RHEL-8	oadp/oadp-velero-rhel8:1.1.1-20	Fixed	RHSA-2022:8634
OSSO-1.1-RHEL-8	openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8:v1.1-11	Fixed	RHSA-2022:6152
OpenShift Custom Metrics Autoscaler 2	custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8:2.8.2-143	Fixed	RHSA-2023:1042
Openshift Serveless 1.24	openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8:1.3.2-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8:1.3.2-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1-tech-preview/eventing-kafka-broker-webhook-rhel8:1.3.2-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/client-kn-rhel8:1.3.1-4	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-controller-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.3.2-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.3.2-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.3.2-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-mtping-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-storage-version-migration-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-sugar-controller-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/eventing-webhook-rhel8:1.3.2-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/ingress-rhel8-operator:1.24.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/kn-cli-artifacts-rhel8:1.3.1-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/knative-rhel8-operator:1.24.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/kourier-control-rhel8:1.3.0-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/net-istio-controller-rhel8:1.3.0-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/net-istio-webhook-rhel8:1.3.0-2	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serverless-operator-bundle:1.24.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serverless-rhel8-operator:1.24.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-activator-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-autoscaler-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-controller-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-domain-mapping-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-queue-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-storage-version-migration-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/serving-webhook-rhel8:1.3.0-3	Fixed	RHSA-2022:6040
Openshift Serveless 1.24	openshift-serverless-1/svls-must-gather-rhel8:1.24.0-2	Fixed	RHSA-2022:6040
Openshift Serverless 1 on RHEL 8	openshift-serverless-clients-0:1.3.1-4.el8	Fixed	RHSA-2022:6042
RHEL-7-CNV-4.12	kubevirt-0:4.12.0-1057.el7	Fixed	RHSA-2023:0407
RHEL-8-CNV-4.12	container-native-virtualization/virt-api:v4.12.0-255	Fixed	RHSA-2023:0408
RHEL-8-CNV-4.12	kubevirt-0:4.12.0-1057.el8	Fixed	RHSA-2023:0407
RHODF-4.13-RHEL-9	odf4/mcg-rhel9-operator:v4.13.0-41	Fixed	RHSA-2023:3742
Red Hat Ceph Storage 6.1	rhceph/rhceph-6-dashboard-rhel9:6-75	Fixed	RHSA-2023:3642
Red Hat Developer Tools	go-toolset-1.17-golang-0:1.17.12-1.el7_9	Fixed	RHSA-2022:5866
Red Hat Enterprise Linux 8	container-tools:4.0-8080020230217080101.8108cfbc	Fixed	RHSA-2023:2802
Red Hat Enterprise Linux 8	container-tools:rhel8-8080020230321153727.0f77c1b7	Fixed	RHSA-2023:2758
Red Hat Enterprise Linux 8	git-lfs-0:2.13.3-3.el8_6	Fixed	RHSA-2022:7129
Red Hat Enterprise Linux 8	go-toolset:rhel8-8060020220720230014.97d7f71f	Fixed	RHSA-2022:5775
Red Hat Enterprise Linux 8	grafana-0:7.5.15-3.el8	Fixed	RHSA-2022:7519
Red Hat Enterprise Linux 8	grafana-pcp-0:3.2.0-2.el8	Fixed	RHSA-2022:7648
Red Hat Enterprise Linux 9	git-lfs-0:3.2.0-1.el9	Fixed	RHSA-2023:2357
Red Hat Enterprise Linux 9	golang-0:1.17.12-1.el9_0	Fixed	RHSA-2022:5799
Red Hat Enterprise Linux 9	grafana-0:7.5.15-3.el9	Fixed	RHSA-2022:8057
Red Hat Enterprise Linux 9	grafana-pcp-0:3.2.0-3.el9	Fixed	RHSA-2022:8250
Red Hat Migration Toolkit for Containers 1.7	rhmtc/openshift-velero-plugin-rhel8:v1.7.6-5	Fixed	RHSA-2022:9047
Red Hat OpenShift Service Mesh 2.2 for RHEL 8	openshift-service-mesh/istio-cni-rhel8:2.2.2-7	Fixed	RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8	openshift-service-mesh/istio-rhel8-operator:2.2.2-8	Fixed	RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8	openshift-service-mesh/pilot-rhel8:2.2.2-7	Fixed	RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8	openshift-service-mesh/prometheus-rhel8:2.2.2-4	Fixed	RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8	openshift-service-mesh/proxyv2-rhel8:2.2.2-8	Fixed	RHSA-2022:6283
Red Hat OpenShift Service Mesh 2.2 for RHEL 8	openshift-service-mesh/ratelimit-rhel8:2.2.2-4	Fixed	RHSA-2022:6283
Red Hat OpenStack Platform 16.1	etcd-0:3.3.23-12.el8ost	Fixed	RHSA-2023:1275
Red Hat OpenStack Platform 16.2	etcd-0:3.3.23-12.el8ost	Fixed	RHSA-2023:1275
Migration Toolkit for Virtualization	migration-toolkit-virtualization/mtv-controller-rhel9	Affected	n/a
OpenShift Developer Tools and Services	odo	Affected	n/a
OpenShift Pipelines	openshift-pipelines-client	Affected	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/gatekeeper-rhel8-operator	Affected	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/subctl-rhel9	Affected	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/volsync-rhel9	Affected	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/work-rhel8	Affected	n/a
Red Hat Advanced Cluster Security 3	advanced-cluster-security/rhacs-main-rhel8	Affected	n/a
Red Hat Ansible Automation Platform 2	openshift-clients	Affected	n/a
Red Hat Ceph Storage 3	golang	Out of support scope	n/a
Red Hat Ceph Storage 5	rhceph/rhceph-5-dashboard-rhel8	Affected	n/a
Red Hat Enterprise Linux 8	container-tools:3.0/containernetworking-plugins	Affected	n/a
Red Hat Enterprise Linux 8	osbuild-composer	Will not fix	n/a
Red Hat Enterprise Linux 9	containernetworking-plugins	Will not fix	n/a
Red Hat Enterprise Linux 9	go-toolset	Affected	n/a
Red Hat Enterprise Linux 9	osbuild-composer	Will not fix	n/a
Red Hat OpenShift Container Platform 4	openshift-golang-builder-container	Not affected	n/a
Red Hat OpenShift GitOps	openshift-gitops-1/gitops-rhel8	Affected	n/a
Red Hat OpenShift GitOps	openshift-gitops-kam	Affected	n/a
Red Hat OpenShift distributed tracing 2	rhosdt/jaeger-agent-rhel8	Not affected	n/a
Red Hat OpenStack Platform 16.2	rhosp-rhel8-tech-preview/osp-director-operator	Will not fix	n/a
Red Hat Openshift Data Foundation 4	mcg	Affected	n/a
Red Hat Openshift Data Foundation 4	odf4/cephcsi-rhel9	Affected	n/a
Red Hat Quay 3	quay/clair-rhel8	Affected	n/a
Red Hat Software Collections	rh-git227-git-lfs	Will not fix	n/a
Red Hat Storage 3	go-toolset-7-golang	Will not fix	n/a
Red Hat Storage 3	golang	Will not fix	n/a
Red Hat Storage 3	heketi	Out of support scope	n/a
Red Hat Web Terminal	web-terminal-exec-container	Affected	n/a

Ecosystem	Package	Introduced	Fixed
Go	stdlib	1.18.0-0	1.18.4
Go	stdlib	0	1.17.12

Remediation

Red Hat statement

OpenShift Container Platform (OCP) starting from 4.10 stream is already compiled in the patched version of Go, hence is not affected by this vulnerability.The vulnerability has been rated as moderate instead of high because the vulnerability can only result in a minor denial of service.

Weaknesses (2)

CWE-1325

CWE-674

References (10)

https://access.redhat.com/security/cve/CVE-2022-30635
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2107388
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52466
Advisory
https://go.dev/cl/417064
PatchVendor Advisory
https://go.dev/issue/53615
Issue TrackingVendor Advisory
https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7
Mailing ListPatchVendor Advisory
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
Mailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30635
https://pkg.go.dev/vuln/GO-2022-0526
Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2022-30635

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-30635		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2107388		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52466		Advisory
https://go.dev/cl/417064		PatchVendor Advisory
https://go.dev/issue/53615		Issue TrackingVendor Advisory
https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7		Mailing ListPatchVendor Advisory
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE		Mailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30635
https://pkg.go.dev/vuln/GO-2022-0526		Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2022-30635