Path traversal in Go programming language - CVE-2022-41722

Vulnerability identifier: #VU73721

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41722

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the filepath.Clean() function on Windows, which can transform an invalid path such as "a/../c:/b" into the valid path "c:". As a result, an attacker can read arbitrary files on the system.

Go programming language
Amazon Linux AMI
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
openSUSE Leap
Astronomer with IBM
ObjectScale
IBM Spectrum Copy Data Management
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus
IBM Observability with Instana
Red Hat OpenShift Container Platform
Splunk Enterprise
golang
go1.19
go1.19-doc
go1.19-race
go1.20-doc
go1.20-race
go1.20

Install update from vendor's website.

Go programming language - addressed in versions 1.19.6, 1.20.1
Astronomer with IBM - update to 1.0.1
IBM Spectrum Copy Data Management - update to 2.2.20.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Red Hat OpenShift Container Platform - addressed in versions 4.13.1, 4.13.2
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
ObjectScale - update to 1.4.0
golang - addressed in versions 1.18.6-1.43, 1.19.8-1
go1.19 - update to 1.19.7-150000.1.23.1
go1.19-doc - update to 1.19.7-150000.1.23.1
go1.19-race - update to 1.19.7-150000.1.23.1
go1.20-doc - update to 1.20.2-150000.1.5.1
go1.20-race - update to 1.20.2-150000.1.5.1
go1.20 - update to 1.20.2-150000.1.5.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.4
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.4
IBM Spectrum Protect Plus - update to 10.1.15
IBM Observability with Instana - update to 281

• https://pkg.go.dev/vuln/GO-2023-1568
• https://go.dev/cl/468123
• https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
• https://go.dev/issue/57274

• Multiple vulnerabilities in Go programming language
• SUSE update for go1.20
• SUSE update for go1.19
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• OpenShift Container Platform 4.13 update for golang
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Astronomer with IBM