Resource exhaustion in Go programming language - CVE-2022-23772

Vulnerability identifier: #VU62038

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-23772

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Go programming language
Amazon Linux AMI
Gentoo Linux
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
Fedora
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Anolis OS
Oracle Solaris
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openEuler
openshift-serverless-clients (Red Hat package)
servicemesh-ratelimit (Red Hat package)
servicemesh-operator (Red Hat package)
servicemesh (Red Hat package)
servicemesh-proxy (Red Hat package)
servicemesh-prometheus (Red Hat package)
mcg (Red Hat package)
toolbox (Red Hat package)
python-ifaddr (Red Hat package)
python-wcwidth (Red Hat package)
python-iso8601 (Red Hat package)
python-zake (Red Hat package)
python-sqlparse (Red Hat package)
rust-bootupd (Red Hat package)
python-oslo-metrics (Red Hat package)
python-logutils (Red Hat package)
python-colorama (Red Hat package)
python-greenlet (Red Hat package)
python-zipp (Red Hat package)
python-tempita (Red Hat package)
python-msgpack (Red Hat package)
python-prometheus_client (Red Hat package)
python-repoze-lru (Red Hat package)
python-simplegeneric (Red Hat package)
python-dataclasses (Red Hat package)
python-pint (Red Hat package)
python-wsme (Red Hat package)
python-scciclient (Red Hat package)
python-voluptuous (Red Hat package)
python-migrate (Red Hat package)
python-fasteners (Red Hat package)
butane (Red Hat package)
coreos-installer (Red Hat package)
python-pyrsistent (Red Hat package)
console-login-helper-messages (Red Hat package)
python-zeroconf (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
containernetworking-plugins (Red Hat package)
python-funcsigs (Red Hat package)
python-yappi (Red Hat package)
python-editor (Red Hat package)
libsodium (Red Hat package)
python-flask (Red Hat package)
runc (Red Hat package)
python-dogpile-cache (Red Hat package)
slirp4netns (Red Hat package)
python-rfc3986 (Red Hat package)
python-retrying (Red Hat package)
python-jsonpath-rw (Red Hat package)
python-vine (Red Hat package)
python-pynacl (Red Hat package)
python-pecan (Red Hat package)
python-warlock (Red Hat package)
python-requestsexceptions (Red Hat package)
python-appdirs (Red Hat package)
crun (Red Hat package)
python-alembic (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
skopeo (Red Hat package)
python-pyperclip (Red Hat package)
python-os-service-types (Red Hat package)
python-importlib-metadata (Red Hat package)
delve
python-webob (Red Hat package)
fuse-overlayfs (Red Hat package)
python-pycdlib (Red Hat package)
python-wrapt (Red Hat package)
python-six (Red Hat package)
golang-help
golang-devel
golang
go1.16-race
go1.16-doc
go1.16
golang-docs
golang-tests
go-toolset
golang-src
golang-misc
golang-race
golang-bin
go1.17-doc
go1.17-race
go1.17
containers-common (Red Hat package)
buildah (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
python-memcached (Red Hat package)
python-waitress (Red Hat package)
python-paste-deploy (Red Hat package)
python-werkzeug (Red Hat package)
python-webtest (Red Hat package)
python-soupsieve (Red Hat package)
conmon (Red Hat package)
haproxy (Red Hat package)
pyparsing (Red Hat package)
python-SecretStorage (Red Hat package)
python-munch (Red Hat package)
python-futurist (Red Hat package)
python-routes (Red Hat package)
kata-containers (Red Hat package)
python-automaton (Red Hat package)
python-debtcollector (Red Hat package)
python-osc-lib (Red Hat package)
python-amqp (Red Hat package)
python-oslo-versionedobjects (Red Hat package)
python-os-traits (Red Hat package)
python-kazoo (Red Hat package)
python-oslo-service (Red Hat package)
python-oslo-cache (Red Hat package)
python-construct (Red Hat package)
python-tooz (Red Hat package)
python-proliantutils (Red Hat package)
ignition (Red Hat package)
openvswitch2.17 (Red Hat package)
container-selinux (Red Hat package)
python-cachetools (Red Hat package)
python-pycadf (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
python-bcrypt (Red Hat package)
python-jsonschema (Red Hat package)
python-statsd (Red Hat package)
python-paste (Red Hat package)
python-redis (Red Hat package)
python-singledispatch (Red Hat package)
python-osprofiler (Red Hat package)
python-stevedore (Red Hat package)
python-glanceclient (Red Hat package)
python-cliff (Red Hat package)
python-oslo-policy (Red Hat package)
python-swiftclient (Red Hat package)
criu (Red Hat package)
python-simplejson (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
podman (Red Hat package)
python-oslo-context (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneclient (Red Hat package)
libslirp (Red Hat package)
python-decorator (Red Hat package)
pysnmp (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-middleware (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-pexpect (Red Hat package)
python-kombu (Red Hat package)
python-beautifulsoup4 (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-ansible (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
python-oslo-utils (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
python-oslo-i18n (Red Hat package)
python-ironic-lib (Red Hat package)
rust-afterburn (Red Hat package)
python-pbr (Red Hat package)
python-tenacity (Red Hat package)
python-oslo-rootwrap (Red Hat package)
python-dracclient (Red Hat package)
python-cinderclient (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-config (Red Hat package)
python-oslo-db (Red Hat package)
python-keystonemiddleware (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-oslo-messaging (Red Hat package)
openstack-ironic (Red Hat package)
python-packaging (Red Hat package)
python-keyring (Red Hat package)
ovn22.03 (Red Hat package)
ovn22.06 (Red Hat package)
Red Hat OpenShift Serverless
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
Service Telemetry Framework
IBM Cloud Pak for Multicloud Management Monitoring
IBM Cloud Automation Manager
IBM Robotic Process Automation
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Netcool Operations Insight
IBM Cloud Pak for Multicloud Management Security Services
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Protect Plus
QRadar Suite
Splunk Enterprise
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
IBM Netezza for Cloud Pak for Data
Dell PowerProtect Cyber Recovery
Red Hat OpenShift Container Platform
OpenShift Serverless Client

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the Rat.SetString(0 function in math/big. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
• https://security.netapp.com/advisory/ntap-20220225-0006/