Read the docs
TI-2022-12768 Aliases CVE-2022-30632GHSA-hc24-7m29-5vj7

Stack exhaustion on crafted paths in path/filepath

Priority LOW 37CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 19 fixed, 24 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-674.

Summary

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Why it matters now

EPSS 0.0219 82nd percentileScored 2026-11-07
Fix Partial path/filepath (Go standard library): 1.17.12, 1.18.4Red Hat: 34 advisoriesRed Hat: 19 fixed, 24 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarypath/filepathbefore 1.17.12; 1.18.0-0 to before 1.18.41.17.12, 1.18.4Patch availableCNA
  • path/filepath VendorGo standard library Affected before 1.17.12; 1.18.0-0 to before 1.18.4 Fixed in 1.17.12, 1.18.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.17.12; 1.18.0 to before 1.18.4VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.12; 1.18.0 to before 1.18.4 Vulnerable ·Go standard library

Remediation

  • Fix · CNA path/filepath (Go standard library) Fixed in 1.17.12, 1.18.4

Red Hat 34 advisories

  • RHSA-2024:2180 Released 2024-04-30 · Red Hat rating Moderate
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.12-2.el9
  • RHSA-2023:3642 Released 2023-06-15 · Red Hat rating Important
    Red Hat Ceph Storage 6.1 Container security and bug fix update
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
  • RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
Show 31 more Red Hat advisories
  • RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
  • RHSA-2023:2357 Released 2023-05-09 · Red Hat rating Moderate
    git-lfs security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.2.0-1.el9
  • RHSA-2023:1529 Released 2023-03-30 · Red Hat rating Moderate
    Service Telemetry Framework 1.5 security update
    • Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
  • RHSA-2023:1275 Released 2023-03-15 · Red Hat rating Important
    Red Hat OpenStack Platform (etcd) security update
    • Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
  • RHSA-2023:1042 Released 2023-03-06 · Red Hat rating Moderate
    Custom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
    • OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
  • RHSA-2023:0408 Released 2023-01-25 · Red Hat rating Important
    OpenShift Virtualization 4.12.0 Images security update
    • CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
  • RHSA-2023:0407 Released 2023-01-24 · Red Hat rating Moderate
    OpenShift Virtualization 4.12.0 RPMs security update
    • CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
    • CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
  • RHSA-2022:9047 Released 2022-12-15 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.6 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-hook-runner-rhel8, rhmtc/openshift-migration-legacy-rhel8-operator +14
  • RHSA-2022:8634 Released 2022-11-28 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.1.1 security and bug fix update
    • 8Base-OADP-1.1 oadp/oadp-velero-rhel8
  • RHSA-2022:8250 Released 2022-11-15 · Red Hat rating Moderate
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-3.2.0-3.el9
  • RHSA-2022:8098 Released 2022-11-15 · Red Hat rating Moderate
    toolbox security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.3-5.el9, toolbox-tests-0.0.99.3-5.el9
  • RHSA-2022:8057 Released 2022-11-15 · Red Hat rating Important
    grafana security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-7.5.15-3.el9
  • RHSA-2022:7648 Released 2022-11-08 · Red Hat rating Moderate
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-pcp-3.2.0-2.el8
  • RHSA-2022:7529 Released 2022-11-08 · Red Hat rating Moderate
    container-tools:3.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.aarch64::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.ppc64le::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.s390x::container-tools:3.0 +47
  • RHSA-2022:7519 Released 2022-11-08 · Red Hat rating Moderate
    grafana security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-3.el8
  • RHSA-2022:7129 Released 2022-10-25 · Red Hat rating Moderate
    git-lfs security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) git-lfs-2.13.3-3.el8_6
  • RHSA-2022:7058 Released 2022-10-19 · Red Hat rating Moderate
    OpenShift sandboxed containers 1.3.1 security fix and bug fix update
    • OpenShift Sandboxed Containers 1.3 openshift-sandboxed-containers/osc-monitor-rhel8, openshift-sandboxed-containers/osc-must-gather-rhel8, openshift-sandboxed-containers/osc-operator-bundle +1
  • RHSA-2022:6370 Released 2022-09-06 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.6.0 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2022:6345 Released 2022-09-06 · Red Hat rating Moderate
    Multicluster Engine for Kubernetes 2.1 security updates and bug fixes
    • multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
  • RHSA-2022:6347 Released 2022-09-06 · Red Hat rating Moderate
    VolSync 0.5 security fixes and updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/volsync-mover-rsync-rhel8 +3
  • RHSA-2022:6348 Released 2022-09-06 · Red Hat rating Moderate
    Gatekeeper Operator v0.2 security and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/gatekeeper-operator-bundle, rhacm2/gatekeeper-rhel8, rhacm2/gatekeeper-rhel8-operator
  • RHSA-2022:6346 Released 2022-09-06 · Red Hat rating Moderate
    RHSA: Submariner 0.13 - security and enhancement update
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/nettest-rhel8 +7
  • RHSA-2022:6152 Released 2022-09-01 · Red Hat rating Important
    Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update
    • OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
  • RHSA-2022:6283 Released 2022-08-31 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.2.2 Containers security update
    • RHOSSM 2.2 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/pilot-rhel8 +3
  • RHSA-2022:6188 Released 2022-08-25 · Red Hat rating Important
    Node Maintenance Operator 4.11.1 security update
    • Node Maintenance Operator 4.11 for RHEL 8 workload-availability/node-maintenance-rhel8-operator
  • RHSA-2022:6113 Released 2022-08-18 · Red Hat rating Important
    Red Hat Application Interconnect 1.0 Release (rpms)
    • Red Hat Service Interconnect 1 skupper-cli-1.0.2-2.el8
  • RHSA-2022:6040 Released 2022-08-10 · Red Hat rating Important
    Release of OpenShift Serverless 1.24.0
    • Red Hat OpenShift Serverless 1.24 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
  • RHSA-2022:6042 Released 2022-08-10 · Red Hat rating Important
    Release of OpenShift Serverless Client kn 1.24.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.3.1-4.el8
  • RHSA-2022:5866 Released 2022-08-02 · Red Hat rating Important
    go-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-1.17.12-1.el7_9, go-toolset-1.17-build-1.17.12-1.el7_9, go-toolset-1.17-golang-1.17.12-1.el7_9 +8
  • RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Important
    go-toolset and golang security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
  • RHSA-2022:5775 Released 2022-08-01 · Red Hat rating Important
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.12-1.module+el8.6.0+16014+a372c00b.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet
Node Maintenance OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Application Interconnect 1.0AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Web TerminalAffectedNo fix yet
Service Telemetry Framework 1.4 for RHEL 8AffectedNo fix planned: Will not fix
mirror registry for Red Hat OpenShiftAffectedNo fix yet
8Base-OADP-1.1Fixed RHSA-2022:8634
8Base-RHMTC-1.7Fixed RHSA-2022:9047
CNV 4.12 for RHEL 7Fixed RHSA-2023:0407
CNV 4.12 for RHEL 8Fixed RHSA-2023:0407, RHSA-2023:0408
Node Maintenance Operator 4.11 for RHEL 8Fixed RHSA-2022:6188
OSSO 1.1 for RHEL 8Fixed RHSA-2022:6152
OpenShift Custom Metrics Autoscaler 2Fixed RHSA-2023:1042
OpenShift Sandboxed Containers 1.3Fixed RHSA-2022:7058
RHOSSM 2.2 for RHEL 8Fixed RHSA-2022:6283
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2023:3642
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2022:5866
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:5775, RHSA-2022:7129, RHSA-2022:7519, RHSA-2022:7529, RHSA-2022:7648, RHSA-2023:2758, RHSA-2023:2802
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:5799, RHSA-2022:8057, RHSA-2022:8098, RHSA-2022:8250, RHSA-2023:2357, RHSA-2024:2180
Red Hat OpenShift Serverless 1.0Fixed RHSA-2022:6042
Red Hat OpenShift Serverless 1.24Fixed RHSA-2022:6040
Red Hat OpenStack Platform 16.1Fixed RHSA-2023:1275
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:1275
Red Hat Service Interconnect 1Fixed RHSA-2022:6113
Service Telemetry Framework 1.5 for RHEL 8Fixed RHSA-2023:1529
Not affected: 15 products
  • 8Base-OADP-1.1
  • 8Base-RHMTC-1.7
  • CNV 4.12 for RHEL 8
  • Node Maintenance Operator 4.11 for RHEL 8
  • OSSO 1.1 for RHEL 8
  • OpenShift Custom Metrics Autoscaler 2
  • RHOSSM 2.2 for RHEL 8
  • Red Hat Ceph Storage 6.1 Tools
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenStack Platform 16.2
  • Red Hat Satellite 6
  • Service Telemetry Framework 1.5 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30632
  2. 2026-10-03 Alias added: GHSA-hc24-7m29-5vj7

References

Patch 2

Advisory 3

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences