cbcvebase.
CVE-2022-2879
published 2022-10-14

CVE-2022-2879: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory…

PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.54%
71.9th percentile
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

Affected

29 ranges· showing 25
VendorProductVersion rangeFixed in
debiangolang-1.15< golang-1.19 1.19.2-1 (bookworm)golang-1.19 1.19.2-1 (bookworm)
debiangolang-1.19< golang-1.19 1.19.2-1 (bookworm)golang-1.19 1.19.2-1 (bookworm)
go_standard_libraryarchive_tar< 1.18.71.18.7
go_standard_libraryarchive_tar>= 1.19.0-0 < 1.19.21.19.2
golanggo< 1.18.71.18.7
golanggo>= 1.19.0 < 1.19.21.19.2
msrcazl3_containerized-data-importer_1.57.0-14_on_azure_linux_3.0
msrcazl3_containerized-data-importer_1.57.0-3_on_azure_linux_3.0
msrcazl3_gcc_13.2.0-7_on_azure_linux_3.0
msrcazl3_gh_2.62.0-8_on_azure_linux_3.0
msrcazl3_golang_1.24.3-1_on_azure_linux_3.0
msrcazl3_ig_0.25.0-2_on_azure_linux_3.0
msrcazl3_ig_0.29.0-1_on_azure_linux_3.0
msrcazl3_libcontainers-common_20240213-2_on_azure_linux_3.0
msrcazl3_libcontainers-common_20240213-3_on_azure_linux_3.0
msrcazl3_moby-engine_25.0.3-13_on_azure_linux_3.0
msrcazl3_moby-engine_25.0.3-3_on_azure_linux_3.0
msrcazl3_python-tensorboard_2.16.2-6_on_azure_linux_3.0
msrcazl3_skopeo_1.14.4-1_on_azure_linux_3.0
msrcazl3_skopeo_1.14.4-5_on_azure_linux_3.0
msrcazl3_tensorflow_2.16.1-9_on_azure_linux_3.0
msrcazure_linux_3.0_arm
msrcazure_linux_3.0_x64
msrccbl2_golang_1.17.13-2_on_cbl_mariner_2.0
msrccbl2_golang_1.19.10-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.