csaf_redhat - rhsa-2024

rhsa-2024_10895

Vulnerability from csaf_redhat

Published

2024-12-09 19:09

Modified

2024-12-17 18:25

Summary

Red Hat Security Advisory: Cost Management Metrics Operator Update

Notes

Topic

Cost Management Metrics Operator version 3.3.2 release.

Details

The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every hour to create metric reports that it uploads to Cost Management at console.redhat.com.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Cost Management Metrics Operator version 3.3.2 release.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every hour to create metric reports that it uploads to Cost Management at console.redhat.com.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:10895",
        "url": "https://access.redhat.com/errata/RHSA-2024:10895"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-34155",
        "url": "https://access.redhat.com/security/cve/CVE-2024-34155"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management",
        "url": "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10895.json"
      }
    ],
    "title": "Red Hat Security Advisory: Cost Management Metrics Operator Update",
    "tracking": {
      "current_release_date": "2024-12-17T18:25:15+00:00",
      "generator": {
        "date": "2024-12-17T18:25:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2024:10895",
      "initial_release_date": "2024-12-09T19:09:42+00:00",
      "revision_history": [
        {
          "date": "2024-12-09T19:09:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-12-09T19:09:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-17T18:25:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Cost Management Metrics Operator 3.3.2",
                "product": {
                  "name": "Cost Management Metrics Operator 3.3.2",
                  "product_id": "Cost Management Metrics Operator 3.3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cost_management:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Cost Management Metrics Operator"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3A85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c?arch=amd64\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-operator-bundle@sha256%3A448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945?arch=amd64\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3A6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40?arch=arm64\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3Af02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4?arch=s390x\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3A1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3?arch=ppc64le\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64 as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64 as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64 as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-34155",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2024-09-06T21:20:06.929766+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2310527"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the go/parser package of the Golang standard library. Calling any Parse functions on Go source code containing deeply nested literals can cause a panic due to stack exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-34155"
        },
        {
          "category": "external",
          "summary": "RHBZ#2310527",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310527"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-34155",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-34155"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34155",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34155"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/611238",
          "url": "https://go.dev/cl/611238"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/69138",
          "url": "https://go.dev/issue/69138"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
          "url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-3105",
          "url": "https://pkg.go.dev/vuln/GO-2024-3105"
        }
      ],
      "release_date": "2024-09-06T21:15:11.947000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-12-09T19:09:42+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm- upgrading-operators.html",
          "product_ids": [
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10895"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion"
    }
  ]
}

cve-2024-34155

Vulnerability from cvelistv5

Published

2024-09-06 20:42

Modified

2024-11-04 16:59

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Summary

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

References

▼	URL	Tags
	https://go.dev/cl/611238
	https://go.dev/issue/69138
	https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
	https://pkg.go.dev/vuln/GO-2024-3105

Impacted products

Vendor

Product

Version

▼

Go standard library

go/parser

Version: 0 ≤
Version: 1.23.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34155",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T13:55:36.320331Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T16:59:31.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-26T15:03:07.202Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20240926-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "go/parser",
          "product": "go/parser",
          "programRoutines": [
            {
              "name": "parser.parseLiteralValue"
            },
            {
              "name": "ParseDir"
            },
            {
              "name": "ParseExpr"
            },
            {
              "name": "ParseExprFrom"
            },
            {
              "name": "ParseFile"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.1",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T20:42:42.518Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/611238"
        },
        {
          "url": "https://go.dev/issue/69138"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-3105"
        }
      ],
      "title": "Stack exhaustion in all Parse functions in go/parser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-34155",
    "datePublished": "2024-09-06T20:42:42.518Z",
    "dateReserved": "2024-05-01T18:45:34.846Z",
    "dateUpdated": "2024-11-04T16:59:31.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted