CVE-2022-39213

2022-09-1522:15:11

CWE-125

[email protected]

web.nvd.nist.gov

cve-2022-39213

go-cvss

security vulnerability

cvss v2.0

out-of-bounds read

go module

upgrade prompt

nvd cpe dictionary

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

49.4%

JSON

go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using ParseVector, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag v0.4.0, by the commit d9d478ff0c13b8b09ace030db9262f3c2fe031f4. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined (e.g. AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M). As stated in SECURITY.md, the CPE v2.3 to refer to this Go module is cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*. The entry has already been requested to the NVD CPE dictionary.

Affected configurations

Vulners

NVD

Node

pandatixgo-cvssRange0.2.0–0.4.0

VendorProductVersionCPE
pandatixgo\-cvss*cpe:2.3:a:pandatix:go\-cvss:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pandatix	go\-cvss	*	cpe:2.3:a:pandatix:go\-cvss::::::::

CNA Affected

[
  {
    "product": "go-cvss",
    "vendor": "pandatix",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.2.0, < 0.4.0"
      }
    ]
  }
]