UBUNTU-CVE-2022-1962

Details

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

Affected Packages

golang-1.18

Ubuntu 18.04 LTS

Affected versions:

1.18.1-1ubuntu1~18.04.3

Fixed in:

1.18.1-1ubuntu1~18.04.4

golang-1.18

Ubuntu 20.04 LTS

Affected versions:

1.18.1-1ubuntu1~20.04.1

Fixed in:

1.18.1-1ubuntu1~20.04.2

golang-1.18

Ubuntu 22.04 LTS

Affected versions:

1.18-1ubuntu11.18.1-1ubuntu11.18~beta1-0ubuntu11.18~beta2-1ubuntu11.18~beta2-1ubuntu21.18~rc1-1ubuntu1

Fixed in:

1.18.1-1ubuntu1.1

References

REPORT

https://github.com/golang/go/commit/695be961d57508da5a82217f7415200a11845879

REPORT

https://ubuntu.com/security/CVE-2022-1962

REPORT

https://ubuntu.com/security/notices/USN-6038-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2022-1962