CVE-2022-39213
Description
go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using ParseVector, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag v0.4.0, by the commit d9d478ff0c13b8b09ace030db9262f3c2fe031f4. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined (e.g. AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M). As stated in SECURITY.md, the CPE v2.3 to refer to this Go module is cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*. The entry has already been requested to the NVD CPE dictionary.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/pandatix/go-cvssGo | >= 0.2.0, < 0.4.0 | 0.4.0 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/pandatix/go-cvss/commit/d9d478ff0c13b8b09ace030db9262f3c2fe031f4nvdPatchThird Party AdvisoryWEB
- github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhxnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-xhmf-mmv2-4hhxghsaADVISORY
- github.com/pandatix/go-cvss/blob/master/SECURITY.mdnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-39213ghsaADVISORY
- pkg.go.dev/vuln/GO-2022-1002ghsaWEB
News mentions
0No linked articles in our index yet.