Input validation error in Go programming language - CVE-2022-32189

Vulnerability identifier: #VU66121

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-32189

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in
Float.GobDecode. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Go programming language
Gentoo Linux
Oracle Linux
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Fedora
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Oracle Solaris
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Service Telemetry Framework
IBM Spectrum Copy Data Management
Ansible Automation Platform
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
Red Hat Migration Toolkit for Applications
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Operations Dashboard
WebSphere Automation
Netcool Operations Insight
IBM MQ Operator
IBM Cloud Pak for Multicloud Management Monitoring
IBM Cloud Pak for Multicloud Management Security Services
IBM Cloud Transformation Advisor
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Spectrum Protect Plus
IBM Robotic Process Automation
QRadar Suite
Splunk Enterprise
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
IBM Cloud Pak System
IBM Watson Machine Learning Accelerator
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Fusion Data Foundation
ObjectScale
Dell EMC Streaming Data Platform
IBM Cloud Pak for Watson AIOps
Storage Ceph
IBM Netezza for Cloud Pak for Data
Dell PowerProtect Cyber Recovery
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
golang-1.13 (Ubuntu package)
golang-1.13-go (Ubuntu package)
golang-1.13-src (Ubuntu package)
golang-1.16 (Ubuntu package)
golang-1.16-go (Ubuntu package)
golang-1.16-src (Ubuntu package)
toolbox (Red Hat package)
python3-pypodman
podman
podman-debuginfo
podman-debugsource
podman-help
python3-podman
podman-docker
butane (Red Hat package)
golang
golang-help
golang-devel
go1.17-doc
go1.17-race
go1.17
golang-1.18-go (Ubuntu package)
golang-1.18 (Ubuntu package)
golang-1.18-src (Ubuntu package)
go1.18-doc
go1.18
go1.18-race
go1.18-openssl-race
go1.18-openssl-doc
go1.18-openssl
cri-tools (Red Hat package)
cri-o (Red Hat package)
git-lfs (Red Hat package)
git-lfs
ignition (Red Hat package)
openvswitch2.17 (Red Hat package)
etcd (Red Hat package)
podman-plugins
podman-remote
podman-gvproxy
python-sushy (Red Hat package)
podman-tests
podmansh
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
openshift-ansible (Red Hat package)
kubevirt (Red Hat package)
weldr-client (Red Hat package)
cockpit-composer (Red Hat package)
osbuild-composer (Red Hat package)
osbuild (Red Hat package)
watsonx.data
Cloud Pak for Data
Red Hat Ceph Storage
AMQ Broker
IBM CICS TX Standard

Install updates from vendor's website.

Go programming language - addressed in versions 1.17.13, 1.18.5
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.1.1
Migration Toolkit for Containers - addressed in versions 1.7.6, 1.7.7, 1.7.8
QRadar Suite - update to 1.10.18.0
IBM Spectrum Copy Data Management - update to 2.2.18
OpenShift Service Mesh - addressed in versions 2.3.1, 2.4.0
IBM Cloud Pak System - update to 2.3.3.6
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
Storage Fusion Data Foundation - update to 4.13
Red Hat OpenShift Container Platform - addressed in versions 4.11.16, 4.11.17, 4.11.24, 4.12.0
OpenShift Logging - update to 5.5.5
Red Hat Migration Toolkit for Applications - update to 6.1.0
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.2
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.2
Operations Dashboard - addressed in versions 2020.4.1-13, 2022.2.1-2
golang-1.13 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.2, 1.13.8-1ubuntu2.22.04.2
golang-1.13-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.2, 1.13.8-1ubuntu2.22.04.2
golang-1.13-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.13.8-1ubuntu1.2, 1.13.8-1ubuntu2.22.04.2
golang-1.16 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.16.2-0ubuntu1~20.04.1
golang-1.16-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.16.2-0ubuntu1~20.04.1
golang-1.16-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.16.2-0ubuntu1~20.04.1
toolbox (Red Hat package) - update to 0.0.99.3-9.el9
python3-pypodman - update to 0.10.1-10
podman - addressed in versions 0.10.1-10, 3.4.4-5, 4.9.4-13
podman-debuginfo - addressed in versions 0.10.1-10, 3.4.4-5, 4.9.4-13
podman-debugsource - addressed in versions 0.10.1-10, 3.4.4-5, 4.9.4-13
podman-help - addressed in versions 0.10.1-10, 3.4.4-5, 4.9.4-13
python3-podman - update to 0.10.1-10
podman-docker - addressed in versions 0.10.1-10, 3.4.4-5, 4.9.4-13
butane (Red Hat package) - addressed in versions 0.15.0-3.rhaos4.11.el8, 0.16.0-1.el9
ObjectScale - update to 1.4.0
WebSphere Automation - update to 1.5.2
Netcool Operations Insight - update to 1.6.9
Dell EMC Streaming Data Platform - update to 1.7.0
golang - update to 1.15.7-15
golang-help - update to 1.15.7-15
golang-devel - update to 1.15.7-15
go1.17-doc - update to 1.17.13-150000.1.42.1
go1.17-race - update to 1.17.13-150000.1.42.1
go1.17 - update to 1.17.13-150000.1.42.1
golang-1.18-go (Ubuntu package) - addressed in versions 1.18.1-1ubuntu1.1, 1.18.1-1ubuntu1~18.04.4, 1.18.1-1ubuntu1~20.04.2
golang-1.18 (Ubuntu package) - addressed in versions 1.18.1-1ubuntu1.1, 1.18.1-1ubuntu1~18.04.4, 1.18.1-1ubuntu1~20.04.2
golang-1.18-src (Ubuntu package) - addressed in versions 1.18.1-1ubuntu1.1, 1.18.1-1ubuntu1~18.04.4, 1.18.1-1ubuntu1~20.04.2
golang - addressed in versions 1.18.5-1.fc36, 1.18.9-1.el7
go1.18-doc - update to 1.18.5-150000.1.25.1
go1.18 - update to 1.18.5-150000.1.25.1
go1.18-race - update to 1.18.5-150000.1.25.1
golang - addressed in versions 1.18.6-1.43, 1.19.3-2
go1.18-openssl-race - update to 1.18.10.1-150000.1.9.1
go1.18-openssl-doc - update to 1.18.10.1-150000.1.9.1
go1.18-openssl - update to 1.18.10.1-150000.1.9.1
cri-tools (Red Hat package) - update to 1.24.2-7.el8
cri-o (Red Hat package) - update to 1.24.3-6.rhaos4.11.gitc4567c0.el8
watsonx.data - update to 2.0.1
IBM MQ Operator - addressed in versions 2.0.13, 2.4.1
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 6
IBM Cloud Pak for Multicloud Management Security Services - update to 2.3 Fix Pack 6
git-lfs (Red Hat package) - addressed in versions 2.13.3-3.el8_6, 3.2.0-1.el9
git-lfs - update to 2.13.3-3.0.1
ignition (Red Hat package) - update to 2.14.0-5.rhaos4.11.el8
openvswitch2.17 (Red Hat package) - update to 2.17.0-62.el8fdp
etcd (Red Hat package) - update to 3.3.23-12.el8ost
podman-plugins - addressed in versions 3.4.4-5, 4.9.4-13
podman-remote - addressed in versions 3.4.4-5, 4.9.4-13
podman-gvproxy - addressed in versions 3.4.4-5, 4.9.4-13
IBM Cloud Transformation Advisor - update to 3.5.0
IBM Cloud Pak for Watson AIOps - update to 3.6.2
python-sushy (Red Hat package) - update to 4.1.3-0.20221107175431.1da4385.el8
IBM Decision Optimization for Cloud Pak for Data - update to 4.6.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
Cloud Pak for Data - update to 4.8.5
podman-tests - update to 4.9.4-13
podmansh - update to 4.9.4-13
atomic-openshift-service-idler (Red Hat package) - update to 4.11.0-202211072116.p0.ga0f9090.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.11.0-202211072116.p0.g93daed6.assembly.stream.el8
openshift-clients (Red Hat package) - update to 4.11.0-202211072116.p0.g142cb44.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.11.0-202211072116.p0.g5157800.assembly.stream.el8, 4.11.0-202211091106.p0.g5658434.assembly.stream.el8
openshift-ansible (Red Hat package) - update to 4.11.0-202211072116.p0.gdf73941.assembly.stream.el8
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
OpenShift Virtualization - update to 4.13.0
kubevirt (Red Hat package) - addressed in versions 4.13.0-1469.el7, 4.13.0-1469.el8, 4.13.0-1469.el9
App Connect Enterprise Certified Container - addressed in versions 5.0.3, 7.0.0
Red Hat Ceph Storage - update to 6.1
Storage Ceph - update to 6.1
AMQ Broker - update to 7.12.0
IBM Spectrum Protect Plus - update to 10.1.15
IBM CICS TX Standard - update to 11.1.0.0 ifix6
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3
Dell PowerProtect Cyber Recovery - update to 19.14.0.2
IBM Robotic Process Automation - update to 21.0.5
weldr-client (Red Hat package) - addressed in versions 35.5-4.el8, 35.5-4.el9
cockpit-composer (Red Hat package) - addressed in versions 41-1.el8, 41-1.el9
osbuild-composer (Red Hat package) - addressed in versions 62-1.el8, 62.1-1.el9
osbuild (Red Hat package) - addressed in versions 65-1.el8, 65-1.el9

• https://github.com/golang/go/issues/53871
• https://github.com/golang/vulndb/issues/537

• Denial of service in Go programming language
• Gentoo update for Go
• SUSE update for go1.17
• SUSE update for go1.18
• Multiple vulnerabilities in Operations Dashboard
• Red Hat Enterprise Linux 8 update for git-lfs
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Red Hat Enterprise Linux 8 update for golang
• Red Hat Enterprise Linux 9 update for golang
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• OpenShift Container Platform 4.11 update for Go
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Logging 5.5
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Input validation error in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• Input validation error in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Decision Optimization in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM CICS TX Standard
• Red Hat OpenStack Platform update for etcd
• Multiple vulnerabilities in Oracle Solaris
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Service Telemetry Framework
• Multiple vulnerabilities in IBM WebSphere Automation
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Cloud Pak System
• Amazon Linux AMI update for golang
• Ubuntu update for golang-1.18
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Red Hat Enterprise Linux 9 update for git-lfs
• Red Hat Enterprise Linux 9 update for toolbox
• Red Hat Enterprise Linux 9 update for butane
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 8 update for the container-tools:4.0 module
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in OpenShift Virtualization 4.13 images
• Multiple vulnerabilities in OpenShift Virtualization 4.13 RPMs
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift
• SUSE update for go1.18-openssl
• Multiple vulnerabilities in Red Hat Ceph Storage
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.4
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell Streaming Data Platform
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Fedora EPEL 7 update for golang
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Storage Ceph
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Ubuntu update for golang-1.13
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Security Services
• openEuler update for golang
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Multiple vulnerabilities in AMQ Broker 7.12
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM watsonx.data
• Fedora 36 update for golang
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)
• openEuler 22.03 LTS SP3 update for podman
• openEuler 24.03 LTS SP1 update for podman
• openEuler 22.03 LTS SP4 update for podman
• openEuler 24.03 LTS update for podman
• openEuler 20.03 LTS SP4 update for podman
• Anolis OS update for git-lfs
• Multiple vulnerabilities in IBM Storage Fusion Data Foundation
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data