CVE-2022-2879 Unbounded memory consumption when reading headers in archive/tar

2022-10-1400:00:00

www.cve.org

cve-2022-2879

memory consumption

archive/tar

resource exhaustion

7.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.0%

JSON

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "archive/tar",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "archive/tar",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.18.7",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.19.0-0",
        "lessThan": "1.19.2",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Reader.next"
      },
      {
        "name": "parsePAX"
      },
      {
        "name": "Writer.writePAXHeader"
      },
      {
        "name": "Reader.Next"
      },
      {
        "name": "Writer.WriteHeader"
      }
    ],
    "defaultStatus": "unaffected"
  }
]