Vulnerability-Lookup

CVE-2022-30634 (GCVE-0-2022-30634)

Vulnerability from cvelistv5 – Published: 2022-07-15 19:36 – Updated: 2024-08-03 06:56

Title

Indefinite hang with large buffers on Windows in crypto/rand

Summary

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/cl/402257
https://go.googlesource.com/go/+/bb1f441618051123…
https://go.dev/issue/52561
https://groups.google.com/g/golang-announce/c/TzI…
https://pkg.go.dev/vuln/GO-2022-0477

Impacted products

1 product

Vendor	Product	Version	CPE status
Go standard library	crypto/rand	Affected: 0 , < 1.17.11 (semver) Affected: 1.18.0-0 , < 1.18.3 (semver)	guessed

Credits

Davis Goodin Quim Muntal of Microsoft

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/402257"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/52561"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0477"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/rand",
          "platforms": [
            "windows"
          ],
          "product": "crypto/rand",
          "programRoutines": [
            {
              "name": "Read"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.3",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Davis Goodin"
        },
        {
          "lang": "en",
          "value": "Quim Muntal of Microsoft"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:27.361Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/402257"
        },
        {
          "url": "https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863"
        },
        {
          "url": "https://go.dev/issue/52561"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0477"
        }
      ],
      "title": "Indefinite hang with large buffers on Windows in crypto/rand"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30634",
    "datePublished": "2022-07-15T19:36:19.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T06:56:13.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-30634",
      "date": "2026-09-21",
      "epss": "0.02195",
      "percentile": "0.81493"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:49:20.000Z",
      "cve": "CVE-2022-30634",
      "id": "msrc_CVE-2022-30634",
      "initial_release_date": "2025-09-03T19:44:03.000Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "8",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Indefinite hang with large buffers on Windows in crypto/rand",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2022-30634.json",
      "version": "7"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pkg.go.dev",
                "defaultStatus": "unaffected",
                "packageName": "crypto/rand",
                "platforms": [
                  "windows"
                ],
                "product": "crypto/rand",
                "programRoutines": [
                  {
                    "name": "Read"
                  }
                ],
                "vendor": "Go standard library",
                "versions": [
                  {
                    "lessThan": "1.17.11",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.18.3",
                    "status": "affected",
                    "version": "1.18.0-0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@golang.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "338E9C2D-AE40-4FA3-9A44-08C9B508B756",
                    "versionEndExcluding": "1.17.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6782EAAE-0437-495C-A6B4-1CFB39DAAFA6",
                    "versionEndExcluding": "1.18.3",
                    "versionStartIncluding": "1.18.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5DAE7369-EEC5-405E-9D13-858335FDA647",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes."
          },
          {
            "lang": "es",
            "value": "Un bucle infinito en Read en crypto/rand versiones anteriores a Go 1.17.11 y Go 1.18.3 en Windows, permite a un atacante causar un cuelgue no definido pasando un buffer mayor de 1 \u0026lt;\u0026lt; 32 - 1 bytes"
          }
        ],
        "id": "CVE-2022-30634",
        "lastModified": "2026-06-17T04:43:59.317",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-07-15T20:15:08.597",
        "references": [
          {
            "source": "security@golang.org",
            "tags": [
              "Patch"
            ],
            "url": "https://go.dev/cl/402257"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Exploit",
              "Issue Tracking"
            ],
            "url": "https://go.dev/issue/52561"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0477"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://go.dev/cl/402257"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Issue Tracking"
            ],
            "url": "https://go.dev/issue/52561"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0477"
          }
        ],
        "sourceIdentifier": "security@golang.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-835"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T12:25:43+00:00",
      "cve": "CVE-2022-30634",
      "id": "CVE-2022-30634",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Indefinite hang with large buffers on Windows in crypto/rand",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-30634.json",
      "version": "3"
    }
  }
}

MSRC_CVE-2022-30634

Vulnerability from csaf_microsoft - Published: 2025-09-03 19:44 - Updated: 2026-09-17 01:49

Summary

Indefinite hang with large buffers on Windows in crypto/rand

Scope

1 vulnerability in this advisory, including CVE-2022-30634.

CVE-2022-30634

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known affected: 1 product Known not affected: 8 products

Open the full advisory

OESA-2022-1783 (CVE-2022-32148)

Vulnerability from osv_openeuler – Published: 2022-07-29 11:05 – Updated: 2026-08-06 11:05 – Source website

Summary

golang security update

Details

The Go Programming Language

Security Fix(es):

When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.(CVE-2022-32148)

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.(CVE-2022-30635)

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

Calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion.(CVE-2022-30633)

Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.(CVE-2022-30632)

Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.(CVE-2022-30631)

As required by RFC 8446, section 4.6.1, ticket_age_add now holds arandom 32-bit value. Before this change, this value was always setto 0.(CVE-2022-30629)

Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.(CVE-2022-28131)

Calling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion.(CVE-2022-1962)

The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a chunked encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.(CVE-2022-1705)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-32148	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30635	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30634	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30633	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30632	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30631	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30629	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-28131	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-1962	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-1705	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "golang-1.15.7-14.oe1.aarch64.rpm"
        ],
        "noarch": [
          "golang-devel-1.15.7-14.oe1.noarch.rpm",
          "golang-help-1.15.7-14.oe1.noarch.rpm"
        ],
        "src": [
          "golang-1.15.7-14.oe1.src.rpm"
        ],
        "x86_64": [
          "golang-1.15.7-14.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "golang",
        "purl": "pkg:rpm/openEuler/golang\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.7-14.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "golang-1.15.7-14.oe1.aarch64.rpm"
        ],
        "noarch": [
          "golang-devel-1.15.7-14.oe1.noarch.rpm",
          "golang-help-1.15.7-14.oe1.noarch.rpm"
        ],
        "src": [
          "golang-1.15.7-14.oe1.src.rpm"
        ],
        "x86_64": [
          "golang-1.15.7-14.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP3",
        "name": "golang",
        "purl": "pkg:rpm/openEuler/golang\u0026distro=openEuler-20.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.7-14.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "golang-1.17.3-5.oe2203.aarch64.rpm"
        ],
        "noarch": [
          "golang-devel-1.17.3-5.oe2203.noarch.rpm",
          "golang-help-1.17.3-5.oe2203.noarch.rpm"
        ],
        "src": [
          "golang-1.17.3-5.oe2203.src.rpm"
        ],
        "x86_64": [
          "golang-1.17.3-5.oe2203.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS",
        "name": "golang",
        "purl": "pkg:rpm/openEuler/golang\u0026distro=openEuler-22.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.3-5.oe2203"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Go Programming Language\r\n\r\nSecurity Fix(es):\r\n\r\nWhen httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.(CVE-2022-32148)\n\nCalling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.(CVE-2022-30635)\n\nInfinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u0026lt;\u0026lt; 32 - 1 bytes. (CVE-2022-30634)\n\nCalling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion.(CVE-2022-30633)\n\nCalling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.(CVE-2022-30632)\n\nCalling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.(CVE-2022-30631)\n\nAs required by RFC 8446, section 4.6.1, ticket_age_add now holds arandom 32-bit value. Before this change, this value was always setto 0.(CVE-2022-30629)\n\nCalling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.(CVE-2022-28131)\n\nCalling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion.(CVE-2022-1962)\n\nThe HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a chunked encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.(CVE-2022-1705)",
  "id": "OESA-2022-1783",
  "modified": "2026-08-06T11:05:03Z",
  "published": "2022-07-29T11:05:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1783"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32148"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30635"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30634"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30633"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30632"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30629"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28131"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1962"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1705"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "golang security update",
  "upstream": [
    "CVE-2022-32148",
    "CVE-2022-30635",
    "CVE-2022-30634",
    "CVE-2022-30633",
    "CVE-2022-30632",
    "CVE-2022-30631",
    "CVE-2022-30629",
    "CVE-2022-28131",
    "CVE-2022-1962",
    "CVE-2022-1705"
  ]
}

OPENSUSE-SU-2024:12123-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 20:32

Summary

go1.17-1.17.11-1.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2022-30634.

CVE-2022-30634

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 12 products

Open the full advisory

OPENSUSE-SU-2024:12124-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 20:32

Summary

go1.18-1.18.3-1.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2022-30634.

CVE-2022-30634

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 12 products

Open the full advisory

SUSE-SU-2022:2004-1

Vulnerability from csaf_suse - Published: 2022-06-07 14:34 - Updated: 2022-06-07 14:34

Summary

Security update for go1.17

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2022-30634.

CVE-2022-30634

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 42 products

Open the full advisory

SUSE-SU-2022:2005-1

Vulnerability from csaf_suse - Published: 2022-06-07 14:34 - Updated: 2022-06-07 14:34

Summary

Security update for go1.18

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2022-30634.

CVE-2022-30634

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 40 products

Open the full advisory

SUSE-SU-2023:2312-1

Vulnerability from csaf_suse - Published: 2023-05-30 06:54 - Updated: 2023-05-30 06:54

Summary

Security update for go1.18-openssl

Severity

Important

Scope

28 vulnerabilities in this advisory, including CVE-2022-30634.

CVE-2022-30634

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 66 products

Open the full advisory

UBUNTU-CVE-2022-30634 (CVE-2022-30634)

Vulnerability from osv_ubuntu – Published: 2022-07-15 20:15 – Updated: 2025-10-24 04:53 – Source website

Details

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-30634	REPORT
	https://groups.google.com/g/golang-announce/c/TzI…	REPORT
	https://go.dev/issue/52561	REPORT
	https://github.com/golang/go/commit/32dedaa69e22f…	REPORT
	https://github.com/golang/go/commit/2be03d789de90…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2022-30634	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-1.8",
            "binary_version": "1.8.3-2ubuntu1.18.04.1"
          },
          {
            "binary_name": "golang-1.8-go",
            "binary_version": "1.8.3-2ubuntu1.18.04.1"
          },
          {
            "binary_name": "golang-1.8-go-shared-dev",
            "binary_version": "1.8.3-2ubuntu1.18.04.1"
          },
          {
            "binary_name": "golang-1.8-src",
            "binary_version": "1.8.3-2ubuntu1.18.04.1"
          },
          {
            "binary_name": "libgolang-1.8-std1",
            "binary_version": "1.8.3-2ubuntu1.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "golang-1.8",
        "purl": "pkg:deb/ubuntu/golang-1.8@1.8.3-2ubuntu1.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-2ubuntu1",
        "1.8.3-2ubuntu1.18.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-1.17",
            "binary_version": "1.17.13-3ubuntu1.3"
          },
          {
            "binary_name": "golang-1.17-go",
            "binary_version": "1.17.13-3ubuntu1.3"
          },
          {
            "binary_name": "golang-1.17-src",
            "binary_version": "1.17.13-3ubuntu1.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "golang-1.17",
        "purl": "pkg:deb/ubuntu/golang-1.17@1.17.13-3ubuntu1.3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.17-1ubuntu2",
        "1.17.3-1ubuntu1",
        "1.17.3-1ubuntu2",
        "1.17.13-3ubuntu1",
        "1.17.13-3ubuntu1.2",
        "1.17.13-3ubuntu1.3"
      ]
    }
  ],
  "aliases": [],
  "details": "Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.",
  "id": "UBUNTU-CVE-2022-30634",
  "modified": "2025-10-24T04:53:40Z",
  "published": "2022-07-15T20:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-30634"
    },
    {
      "type": "REPORT",
      "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg"
    },
    {
      "type": "REPORT",
      "url": "https://go.dev/issue/52561"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/golang/go/commit/32dedaa69e22f1a058ae90b9484fd4c3b46fbcbf"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/golang/go/commit/2be03d789de905a4b050ff5f3a51b724e1b09494"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-30634"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-30634"
  ]
}

WID-SEC-W-2022-1461

Vulnerability from csaf_certbund - Published: 2022-09-18 22:00 - Updated: 2023-06-20 22:00

Summary

IBM Spectrum Protect: Mehrere Schwachstellen

Severity

Hoch

Scope

39 vulnerabilities in this advisory, including CVE-2022-30634.

CVE-2022-30634

In IBM Spectrum Protect existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten sowie im Umgang mit Zertifikaten zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode (teils mit Administratorrechten) auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.

Known affected: 1 product

Open the full advisory

WID-SEC-W-2023-1350

Vulnerability from csaf_certbund - Published: 2023-06-01 22:00 - Updated: 2026-07-01 22:00

Summary

Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern

Severity

Mittel

Scope

129 vulnerabilities in this advisory, including CVE-2022-30634.

CVE-2022-30634

Known affected: 11 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-30634 (GCVE-0-2022-30634)

OESA-2022-1783 (CVE-2022-32148)

UBUNTU-CVE-2022-30634 (CVE-2022-30634)

Tags

Sightings

Nomenclature

Related by attack behaviour