Path traversal in Go programming language - CVE-2022-41720

Vulnerability identifier: #VU70332

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41720

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to the way os.DirFS function and http.Dir type handle empty values on Windows, allowing an attacker with control over the path to view arbitrary files on the system.

Go programming language
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
Fedora
SUSE Enterprise Storage
Oracle Solaris
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
Containers Module
Development Tools Module
openSUSE Leap
Astronomer with IBM
ObjectScale
Consul Enterprise
IBM Cloud Pak for Multicloud Management Monitoring
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
Communications Unified Assurance
Splunk Enterprise
golang
go1.18
go1.18-doc
go1.18-race
go1.18-openssl-doc
go1.18-openssl-race
go1.18-openssl
go1.19-race
go1.19-doc
go1.19
container-suseconnect
IBM Cloud Pak System

Install update from vendor's website.

Go programming language - addressed in versions 1.18.9, 1.19.4
Astronomer with IBM - update to 1.0.1
Consul Enterprise - addressed in versions 1.12.8, 1.13.5, 1.14.3
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
ObjectScale - update to 1.4.0
golang - update to 1.18.9-1.el7
go1.18 - update to 1.18.9-150000.1.40.1
go1.18-doc - update to 1.18.9-150000.1.40.1
go1.18-race - update to 1.18.9-150000.1.40.1
go1.18-openssl-doc - update to 1.18.10.1-150000.1.9.1
go1.18-openssl-race - update to 1.18.10.1-150000.1.9.1
go1.18-openssl - update to 1.18.10.1-150000.1.9.1
go1.19-race - update to 1.19.4-150000.1.18.1
go1.19-doc - update to 1.19.4-150000.1.18.1
go1.19 - update to 1.19.4-150000.1.18.1
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 7
IBM Cloud Pak System - update to 2.3.3.6 iFix 1
container-suseconnect - update to 2.4.0-150000.4.24.1
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.4
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.4

• https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
• https://pkg.go.dev/vuln/GO-2022-1143
• https://go.dev/cl/455716
• https://go.dev/issue/56694

• Multiple vulnerabilities in Go programming language
• Consul update for Go programming language
• SUSE update for go1.19
• SUSE update for go1.18
• HashiCorp Consul update for Go
• Multiple vulnerabilities in Communications Unified Assurance
• SUSE update for container-suseconnect
• SUSE update for go1.18-openssl
• Fedora EPEL 7 update for golang
• Multiple vulnerabilities in Oracle Solaris third-party software
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Astronomer with IBM