PT-2022-24814 · Go-Cvss · Go-Cvss

Published 2022-09-15 · Updated 2023-08-18 · CVE-2022-39213

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-cvss versions prior to v0.4.0

Description The issue arises when a full CVSS v2.0 vector string is parsed using the ParseVector function, potentially leading to an Out-of-Bounds Read due to a lack of tests, causing the Go module to panic. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined.

Recommendations For versions prior to v0.4.0, upgrade to version v0.4.0 or later to resolve the issue. As a temporary workaround, consider parsing only CVSS v2.0 vector strings that do not have all attributes defined, such as AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M, until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-39213

GHSA-XHMF-MMV2-4HHX

GO-2022-1002

Affected Products

Go-Cvss

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39213.json · Exploit
• 🔥 https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx · Exploit
• https://github.com/pandatix/go-cvss/commit/d9d478ff0c13b8b09ace030db9262f3c2fe031f4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39213 · Security Note
• https://osv.dev/vulnerability/GO-2022-1002 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xhmf-mmv2-4hhx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39213 · Vendor Advisory
• https://github.com/pandatix/go-cvss · Note
• https://github.com/pandatix/go-cvss/blob/master/SECURITY.md · Note
• https://t.me/cvenotify/36273 · Telegram Post
• https://pkg.go.dev/vuln/GO-2022-1002 · Note
• https://t.me/cibsecurity/49861 · Telegram Post