Read the docs
Red Hat Security Advisory

RHSA-2022:8098

toolbox security and bug fix update

Released 2022-11-15 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2022-12768 CVE-2022-30632 · GHSA-hc24-7m29-5vj7

Stack exhaustion on crafted paths in path/filepath

Priority LOW 37

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0219 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-12767 CVE-2022-30631 · GHSA-r654-8j96-crqx

Stack exhaustion when reading certain archives in compress/gzip

Priority LOW 37

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compres…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02186 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-12766 CVE-2022-30630 · GHSA-vjj7-39vr-35r3

Stack exhaustion in Glob on certain paths in io/fs

Priority LOW 37

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0219 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-01571 CVE-2022-1705 · GHSA-5hv8-7f46-fxf6

Improper sanitization of Transfer-Encoding headers in net/http

Priority LOW 32

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to re…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01531 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-444