Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-87371
HistoryOct 11, 2022 - 12:00 a.m.

Google Golang Denial of Service Vulnerability

2022-10-1100:00:00
China National Vulnerability Database
www.cnvd.org.cn
9
golang
denial-of-service
vulnerability
google
memory consumption
archive/tar
versions

EPSS

0.002

Percentile

58.9%

Google Golang is a statically strongly typed, compiled language from Google, Inc. Go’s syntax is close to that of C, but differs for variable declarations. go supports garbage collection features. go’s parallel model is based on Tony Hall’s Communication Sequential Process (CSP). other languages that take a similar model include Occam and Limbo, but it also has features of Pi computing, such as channel transfer. Open plug-in (Plugin) support in version 1.8 means that some functions can now be dynamically loaded from Go. A denial-of-service vulnerability exists in Google Golang versions prior to 1.18.7, 1.19.0 and later, and prior to 1.19.2, which stems from unrestricted memory consumption when reading headers in archive/tar. An attacker could exploit the vulnerability to cause Read to allocate an unlimited amount of memory, resulting in a denial of service.