CVE-2022-39213 Out-of-bounds Read in go-cvss
Attackers can cause a panic and denial of service in applications using the go-cvss library by providing specific CVSS v2.0 vector strings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39213?
CVE-2022-39213 is a high-severity denial of service vulnerability in pandatix go-cvss, published on 15 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag `v0.4.0`, by the commit `d9d478ff0c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined (e.g. `AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M`). As stated in [SECURITY.md](https://github.com/pandatix/go-cvss/blob/master/SECURITY.md), the CPE v2.3 to refer to this Go module is `cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*`. The entry has already been requested to the NVD CPE dictionary.
Weakness: CWE-125
Which versions are affected by CVE-2022-39213?
3 open source packages ship an affected version, including github.com/pandatix/go-cvss. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pandatix/go-cvss Go | From 0.2.0 | 0.4.0 |
github.com/pandatix/go-cvss Go | From 0.2.0 | 0.4.0 |
github.com/pandatix/go-cvss Go | From 0.2.0 | 0.4.0 |
Products include Pandatix Go-Cvss.
How do I fix CVE-2022-39213?
Upgrade github.com/pandatix/go-cvss to 0.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-39213 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39213 exists.
Sources
Also known as GHSA-xhmf-mmv2-4hhx, GO-2022-1002.