Unscored RHSA-2023:0445 3 CVEs

Red Hat Security Advisory: go-toolset-1.18 security update

Published Sep 30, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 11

Release	Package	Fixed in
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-build	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-golang	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-golang-bin	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-golang-docs	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-golang-misc	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-golang-race	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-golang-src	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-golang-tests	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-runtime	0:1.18.9-1.el7_9
Red Hat · Devtools 2022 devtools:2022	go-toolset-1.18-scldevel	0:1.18.9-1.el7_9

Vulnerabilities 3

Unscored —

CVE-2022-2879

Unbounded memory consumption when reading headers in archive/tar

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Unscored —

CVE-2022-2880

Incorrect sanitization of forwarded query parameters in net/http/httputil

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Unscored —

CVE-2022-41715

Memory exhaustion when compiling regular expressions in regexp/syntax

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132867
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132868
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132872
report
https://bugzilla.redhat.com/show_bug.cgi?id=2137549
report
https://bugzilla.redhat.com/show_bug.cgi?id=2149315
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0445.json
report
https://access.redhat.com/security/cve/CVE-2022-2879
advisory
https://www.cve.org/CVERecord?id=CVE-2022-2879
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2879
article
https://github.com/golang/go/issues/54853
article
https://github.com/vbatts/tar-split/releases/tag/v0.12.1
article
https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
report
https://access.redhat.com/security/cve/CVE-2022-2880
advisory
https://www.cve.org/CVERecord?id=CVE-2022-2880
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2880
article
https://github.com/golang/go/issues/54663
report
https://access.redhat.com/security/cve/CVE-2022-41715
advisory
https://www.cve.org/CVERecord?id=CVE-2022-41715
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41715
article
https://github.com/golang/go/issues/55949