Resource exhaustion in Go programming language - CVE-2022-30631

Vulnerability identifier: #VU66062

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30631

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in Reader.Read method when handling an archive that contains a large number of concatenated 0-length compressed files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Go programming language
Custom Metrics Autoscaler Operator for Red Hat OpenShift
Submariner
Gatekeeper Operator
VolSync
Red Hat Application Interconnect
Service Telemetry Framework
IBM MQ Operator
IBM Spectrum Copy Data Management
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
Red Hat Migration Toolkit for Applications
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
Red Hat OpenStack for IBM Power
Red Hat OpenStack
Operations Dashboard
WebSphere Automation
Netcool Operations Insight
IBM Cloud Pak for Multicloud Management Monitoring
IBM Cloud Pak for Multicloud Management Security Services
Red Hat Advanced Cluster Management for Kubernetes
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Protect Plus
IBM Robotic Process Automation
Amazon Linux AMI
Gentoo Linux
Oracle Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Fedora
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Oracle Solaris
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Module for Development Tools
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
Node Health Check Operator
Self Node Remediation Operator
Multicluster Engine for Kubernetes
OpenShift Service Mesh
Node Maintenance Operator
Red Hat OpenShift Serverless
OpenShift Virtualization
openshift-serverless-clients (Red Hat package)
go-toolset-1.17-golang (Red Hat package)
go-toolset-1.17 (Red Hat package)
etcd (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
golang-1.16-go (Ubuntu package)
golang-1.16 (Ubuntu package)
golang-1.13-src (Ubuntu package)
golang-1.16-src (Ubuntu package)
golang-1.13-go (Ubuntu package)
golang-1.13 (Ubuntu package)
toolbox-tests
toolbox
toolbox (Red Hat package)
udica
containernetworking-plugins
golist
crun
fzf
runc
skupper-cli (Red Hat package)
collectd-libpod-stats (Red Hat package)
slirp4netns
runc (Red Hat package)
oci-seccomp-bpf-hook
skopeo
skopeo-tests
containers-common
fuse-overlayfs
delve
golang-devel
golang-help
golang
go-toolset
golang (Red Hat package)
go-toolset (Red Hat package)
golang-tests
golang-bin
golang-src
golang-race
golang-docs
golang-misc
go1.17-race
go1.17-doc
go1.17
golang-1.18-src (Ubuntu package)
golang-1.18 (Ubuntu package)
golang-1.18-go (Ubuntu package)
go1.18
go1.18-race
go1.18-doc
go1.18-openssl-race
go1.18-openssl-doc
go1.18-openssl
buildah
buildah-tests
golang-github-cpuguy83-md2man
conmon
container-selinux
podman-tests
podman-remote
podman
podman-catatonit
podman-plugins
podman-docker
grafana-pcp (Red Hat package)
criu
crit
python3-criu
libslirp
libslirp-devel
kubevirt (Red Hat package)
grafana (Red Hat package)
cockpit-podman
OpenShift API for Data Protection (OADP)
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
Red Hat Developer Tools
IBM CICS TX Standard
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
OpenShift Serverless Client
QRadar Suite
Splunk Enterprise
IBM Cloud Pak System
IBM Watson Machine Learning Accelerator
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Fusion Data Foundation
ObjectScale
Dell EMC Streaming Data Platform
Storage Ceph
IBM Netezza for Cloud Pak for Data
Dell PowerProtect Cyber Recovery
watsonx.data
Cloud Pak for Data
Red Hat Ceph Storage

Install updates from vendor's website.

Go programming language - addressed in versions 1.17.12, 1.18.4
Submariner - update to 0.13.0
Gatekeeper Operator - update to 0.2
VolSync - update to 0.5.0
Node Health Check Operator - update to 0.3.1
Self Node Remediation Operator - update to 0.4.1
openshift-serverless-clients (Red Hat package) - update to 1.3.1-4.el8
OpenShift API for Data Protection (OADP) - addressed in versions 1.0.4, 1.1.0
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.1.0
IBM MQ Operator - addressed in versions 1.3.8, 2.0.3
Migration Toolkit for Containers - addressed in versions 1.7.4, 1.7.7, 1.7.8
QRadar Suite - update to 1.10.18.0
go-toolset-1.17-golang (Red Hat package) - update to 1.17.12-1.el7_9
go-toolset-1.17 (Red Hat package) - update to 1.17.12-1.el7_9
Multicluster Engine for Kubernetes - update to 2.1
IBM Spectrum Copy Data Management - update to 2.2.18
OpenShift Service Mesh - addressed in versions 2.3.1, 2.4.0
IBM Cloud Pak System - update to 2.3.3.6
Red Hat Advanced Cluster Security for Kubernetes - update to 3.72
etcd (Red Hat package) - update to 3.3.23-10.el8ost
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Red Hat OpenShift Container Platform - addressed in versions 4.6.61, 4.7.56, 4.8.49, 4.10.26, 4.11.1, 4.12.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
Storage Fusion Data Foundation - update to 4.12
Node Maintenance Operator - update to 4.11.1
OpenShift Logging - addressed in versions 5.3.11, 5.3.12, 5.4.5, 5.5.1
Red Hat Migration Toolkit for Applications - update to 6.1.0
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.2
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.2
Red Hat OpenStack - update to 16.2.z
Operations Dashboard - addressed in versions 2020.4.1-13, 2022.2.1-2
golang-1.16-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.16.2-0ubuntu1~20.04.1
golang-1.16 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.16.2-0ubuntu1~20.04.1
golang-1.13-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.2, 1.13.8-1ubuntu2.22.04.2
golang-1.16-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.16.2-0ubuntu1~20.04.1
golang-1.13-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.2, 1.13.8-1ubuntu2.22.04.2
golang-1.13 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.2, 1.13.8-1ubuntu2.22.04.2
toolbox-tests - update to 0.0.99.3-1.0.1
toolbox - update to 0.0.99.3-1.0.1
toolbox (Red Hat package) - update to 0.0.99.3-5.el9
udica - update to 0.2.4-1.0.1
containernetworking-plugins - update to 0.9.1-1.0.1
golist - update to 0.10.1-11
crun - update to 0.18-3.0.1
fzf - update to 0.29.0-2.fc35
runc - update to 1.0.0-73.rc95.0.1
skupper-cli (Red Hat package) - update to 1.0.2-2.el8
collectd-libpod-stats (Red Hat package) - update to 1.0.4-2.el8ost
slirp4netns - update to 1.1.8-1.0.1
runc (Red Hat package) - update to 1.1.12-2.el9
oci-seccomp-bpf-hook - update to 1.2.0-3.0.1
skopeo - update to 1.2.4-2.0.1
skopeo-tests - update to 1.2.4-2.0.1
containers-common - update to 1.2.4-2.0.1
ObjectScale - update to 1.4.0
fuse-overlayfs - update to 1.4.0-2.0.1
WebSphere Automation - update to 1.5.2
Netcool Operations Insight - update to 1.6.9
Dell EMC Streaming Data Platform - update to 1.7.0
delve - update to 1.7.2-1
golang-devel - update to 1.15.7-14
golang-help - update to 1.15.7-14
golang - update to 1.15.7-14
go-toolset - update to 1.17.12-1
golang - update to 1.17.12-1.el7
golang (Red Hat package) - update to 1.17.12-1.el9_0
go-toolset (Red Hat package) - update to 1.17.12-1.el9_0
golang-tests - update to 1.17.12-1.0.1
golang - update to 1.17.12-1.0.1
golang-bin - update to 1.17.12-1.0.1
golang-src - update to 1.17.12-1.0.1
golang-race - update to 1.17.12-1.0.1
golang-docs - update to 1.17.12-1.0.1
golang-misc - update to 1.17.12-1.0.1
go1.17-race - update to 1.17.13-150000.1.42.1
go1.17-doc - update to 1.17.13-150000.1.42.1
go1.17 - update to 1.17.13-150000.1.42.1
golang-1.18-src (Ubuntu package) - addressed in versions 1.18.1-1ubuntu1.1, 1.18.1-1ubuntu1~18.04.4, 1.18.1-1ubuntu1~20.04.2
golang-1.18 (Ubuntu package) - addressed in versions 1.18.1-1ubuntu1.1, 1.18.1-1ubuntu1~18.04.4, 1.18.1-1ubuntu1~20.04.2
golang-1.18-go (Ubuntu package) - addressed in versions 1.18.1-1ubuntu1.1, 1.18.1-1ubuntu1~18.04.4, 1.18.1-1ubuntu1~20.04.2
go1.18 - update to 1.18.5-150000.1.25.1
go1.18-race - update to 1.18.5-150000.1.25.1
go1.18-doc - update to 1.18.5-150000.1.25.1
golang - addressed in versions 1.18.6-1.42, 1.19.3-2
go1.18-openssl-race - update to 1.18.10.1-150000.1.9.1
go1.18-openssl-doc - update to 1.18.10.1-150000.1.9.1
go1.18-openssl - update to 1.18.10.1-150000.1.9.1
buildah - update to 1.19.9-6.0.1
buildah-tests - update to 1.19.9-6.0.1
Red Hat OpenShift Serverless - update to 1.24.0
OpenShift Serverless Client - update to 1.24.0
watsonx.data - update to 2.0.1
golang-github-cpuguy83-md2man - update to 2.0.2-22
conmon - update to 2.0.26-3.0.1
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 6
IBM Cloud Pak for Multicloud Management Security Services - update to 2.3 Fix Pack 6
Red Hat Advanced Cluster Management for Kubernetes - update to 2.6.0
container-selinux - update to 2.189.0-1.0.1
podman-tests - update to 3.0.1-15.0.1
podman-remote - update to 3.0.1-15.0.1
podman - update to 3.0.1-15.0.1
podman-catatonit - update to 3.0.1-15.0.1
podman-plugins - update to 3.0.1-15.0.1
podman-docker - update to 3.0.1-15.0.1
grafana-pcp (Red Hat package) - addressed in versions 3.2.0-2.el8, 3.2.0-3.el9
criu - update to 3.15-1.0.1
crit - update to 3.15-1.0.1
python3-criu - update to 3.15-1.0.1
libslirp - update to 4.3.1-1.0.1
libslirp-devel - update to 4.3.1-1.0.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
Cloud Pak for Data - update to 4.8.5
OpenShift Virtualization - update to 4.12.0
kubevirt (Red Hat package) - addressed in versions 4.12.0-1057.el7, 4.12.0-1057.el8
Storage Ceph - update to 6.1
Red Hat Ceph Storage - update to 6.1
grafana (Red Hat package) - addressed in versions 7.5.15-3.el8, 7.5.15-3.el9
IBM Spectrum Protect Plus - update to 10.1.15
IBM CICS TX Standard - update to 11.1.0.0 ifix6
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3
Dell PowerProtect Cyber Recovery - update to 19.14.0.2
IBM Robotic Process Automation - update to 21.0.5
cockpit-podman - update to 29-2.0.1

• https://bugzilla.redhat.com/show_bug.cgi?id=2107342

• Multiple vulnerabilities in Go programming language
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Red Hat Enterprise Linux 9 update for go-toolset and golang
• Red Hat Developer Tools update for go-toolset-1.17 and go-toolset-1.17-golang
• Gentoo update for Go
• SUSE update for go1.17
• SUSE update for go1.18
• Red Hat Service Telemetry Framework 1.3 update for golang
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in OpenShift Serverless Client
• Multiple vulnerabilities in OpenShift Serverless
• Red Hat OpenStack Platform 16 update for etcd
• Red Hat OpenStack Platform 16 update for collectd-libpod-stats
• Red Hat OpenStack Platform 16.2 update for collectd-libpod-stats
• Red Hat OpenStack Platform 16.2 update for etcd
• Multiple vulnerabilities in Red Hat Application Interconnect
• Multiple vulnerabilities in Logging Subsystem for Red Hat OpenShift
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat Node Health Check Operator
• Multiple vulnerabilities in Red Hat Self Node Remediation Operator
• Multiple vulnerabilities in Red Hat Node Maintenance Operator
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP)
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat Gatekeeper Operator
• Multiple vulnerabilities in Red Hat VolSync
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Multiple vulnerabilities in Submariner
• Multiple vulnerabilities in Multicluster Engine for Kubernetes
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in Openshift Logging 5.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Management
• Multiple vulnerabilities in OpenShift Container Platform 4.6
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.0
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in Red Hat OpenStack Platform 16.2
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in OpenShift Logging 5.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in IBM MQ Operator
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in Operations Dashboard
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat Enterprise Linux 8 update for the container-tools:3.0 module
• Red Hat Enterprise Linux 8 update for grafana-pcp
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 9 update for grafana-pcp
• Red Hat Enterprise Linux 9 update for toolbox
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift
• Multiple vulnerabilities in Oracle Solaris
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Service Telemetry Framework
• Multiple vulnerabilities in IBM WebSphere Automation
• Multiple vulnerabilities in IBM Cloud Pak System
• Ubuntu update for golang-1.18
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 8 update for the container-tools:4.0 module
• SUSE update for go1.18-openssl
• Multiple vulnerabilities in Red Hat Ceph Storage
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.4
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell Streaming Data Platform
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Resource exhaustion in IBM Storage Ceph
• Ubuntu update for golang-1.13
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Security Services
• openEuler update for golang
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Red Hat Enterprise Linux 9 update for runc
• Amazon Linux AMI update for golist
• Amazon Linux AMI update for golang-github-cpuguy83-md2man
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM watsonx.data
• Fedora EPEL 7 update for golang
• Fedora 35 update for fzf
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)
• Anolis OS update for container-tools:3.0 module
• Anolis OS update for go-toolset:an8 module
• IBM Storage Fusion Data Foundation update for Golang Go
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data