CVE-2022-27664

2022-09-0600:00:00

ubuntu.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

60.5%

JSON

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can
cause a denial of service because an HTTP/2 connection can hang during
closing if shutdown were preempted by a fatal error.

Notes

Author	Note
mdeslaur	Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays.
alexmurray	google-guest-agent contains a vendored copy of golang-golang-x-net
mdeslaur	google-guest-agent doesn’t start a http server except in tests containerd does not listen on an HTTP/2 endpoint, so not vulnerable.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchgolang-1.10< anyUNKNOWN
ubuntu14.04noarchgolang-1.10< anyUNKNOWN
ubuntu16.04noarchgolang-1.10< anyUNKNOWN
ubuntu18.04noarchgolang-1.13< 1.13.8-1ubuntu1~18.04.4+esm1UNKNOWN
ubuntu20.04noarchgolang-1.13< 1.13.8-1ubuntu1.2UNKNOWN
ubuntu22.04noarchgolang-1.13< 1.13.8-1ubuntu2.22.04.2UNKNOWN
ubuntu16.04noarchgolang-1.13< 1.13.8-1ubuntu1~16.04.3+esm3UNKNOWN
ubuntu20.04noarchgolang-1.14< anyUNKNOWN
ubuntu18.04noarchgolang-1.16< 1.16.2-0ubuntu1~18.04.2+esm1UNKNOWN
ubuntu20.04noarchgolang-1.16< 1.16.2-0ubuntu1~20.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	golang-1.10	< any	UNKNOWN
ubuntu	14.04	noarch	golang-1.10	< any	UNKNOWN
ubuntu	16.04	noarch	golang-1.10	< any	UNKNOWN
ubuntu	18.04	noarch	golang-1.13	< 1.13.8-1ubuntu1~18.04.4+esm1	UNKNOWN
ubuntu	20.04	noarch	golang-1.13	< 1.13.8-1ubuntu1.2	UNKNOWN
ubuntu	22.04	noarch	golang-1.13	< 1.13.8-1ubuntu2.22.04.2	UNKNOWN
ubuntu	16.04	noarch	golang-1.13	< 1.13.8-1ubuntu1~16.04.3+esm3	UNKNOWN
ubuntu	20.04	noarch	golang-1.14	< any	UNKNOWN
ubuntu	18.04	noarch	golang-1.16	< 1.16.2-0ubuntu1~18.04.2+esm1	UNKNOWN
ubuntu	20.04	noarch	golang-1.16	< 1.16.2-0ubuntu1~20.04.1	UNKNOWN