CVE-2022-41715

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

CVSS v3.0 7.5 HIGH

7.5^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://groups.google.com/g/golang-announce/c/xtuG5faxtaU	Mailing List Release Notes
https://go.dev/issue/55949	Issue Tracking Third Party Advisory
https://pkg.go.dev/vuln/GO-2022-1039	Vendor Advisory
https://go.dev/cl/439356	Patch

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

Information

Published : 2022-10-14 08:16

Updated : 2023-03-03 07:42

NVD link : CVE-2022-41715

Mitre link : CVE-2022-41715

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

golang

go

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU", "name": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU", "tags": ["Mailing List", "Release Notes"], "refsource": "MISC"}, {"url": "https://go.dev/issue/55949", "name": "https://go.dev/issue/55949", "tags": ["Issue Tracking", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://pkg.go.dev/vuln/GO-2022-1039", "name": "https://pkg.go.dev/vuln/GO-2022-1039", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://go.dev/cl/439356", "name": "https://go.dev/cl/439356", "tags": ["Patch"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-41715", "ASSIGNER": "security@golang.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2022-10-14T15:16Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.19.2", "versionStartIncluding": "1.19.0"}, {"cpe23Uri": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.18.7"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-03-03T15:42Z"}