GO-2024-3107
Stack exhaustion in Parse in go/build/constraint
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-34158
- Alias
- BIT-golang-2024-34158
Description
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.22.7, introduced 1.23.0-0, fixed 1.23.1 |
Références
- https://go.dev/cl/611240 FIX
- https://go.dev/issue/69141 REPORT
- https://groups.google.com/g/golang-dev/c/S9POB9NCTdk WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |