GO-2022-1037
Unbounded memory consumption when reading headers in archive/tar
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2022-2879
- Alias
- BIT-golang-2022-2879
Description
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.18.7, introduced 1.19.0-0, fixed 1.19.2 |
Références
- https://go.dev/issue/54853 REPORT
- https://go.dev/cl/439355 FIX
- https://groups.google.com/g/golang-announce/c/xtuG5faxtaU WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |