Skip to content
Fencer Vulns
high 7.5

CVE-2022-23772 json

Uncontrolled memory consumption in math/big

published 2022-02-11 4 y ago modified 2026-09-08 2 mo ago also BIT-golang-2022-23772 , EUVD-2022-28708 , GO-2021-0317

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

Patch / fix

  • bitnami golang 1.16.14, 1.17.7
  • go stdlib 1.16.14, 1.17.7
  • golang go 1.16.14, 1.17.7
  • golang-1.15 Debian 11 1.15.15-1~deb11u3

debian advisories DEBIAN-CVE-2022-23772

  • delve RHEL 8 1.7.2-1.module+el8.6.0+12972+ebab5911
  • golang RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • go-toolset RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-bin RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-src RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-misc RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-race RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19
  • golang-tests RHEL 8 1.17.7-1.module+el8.6.0+14297+32a15e19

red hat advisories RHSA-2022:1819RHSA-2023:3914RHSA-2022:6155RHSA-2022:5068RHSA-2022:5004RHSA-2022:4860

  • go1.16 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +8 more 1.16.14-1.43.1
  • go1.17 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +8 more 1.17.7-1.20.1

suse advisories SUSE-SU-2022:0724-1SUSE-SU-2022:0723-1

  • go1.16 openSUSE Tumbleweed 1.16.14-1.1
  • go1.17 openSUSE Tumbleweed 1.17.7-1.1
  • go1.16 openSUSE Leap 15.3 1.16.14-1.43.1
  • go1.17 openSUSE Leap 15.3 1.17.7-1.20.1

opensuse advisories openSUSE-SU-2024:11843-1openSUSE-SU-2024:11844-1openSUSE-SU-2022:0724-1openSUSE-SU-2022:0723-1

  • delve AlmaLinux 8 1.7.2-1.module_el8.6.0+2736+ec10aba8
  • golang AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • go-toolset AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-bin AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-src AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-misc AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-race AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8
  • golang-tests AlmaLinux 8 1.17.7-1.module_el8.6.0+2736+ec10aba8

almalinux advisories ALSA-2022:1819

  • delve Rocky Linux 8 1.7.2-1.module+el8.6.0+824+8e984c20
  • golang Rocky Linux 8 1.17.7-1.module+el8.6.0+824+8e984c20
  • go-toolset Rocky Linux 8 1.17.7-1.module+el8.6.0+824+8e984c20

rocky linux advisories RLSA-2022:1819

  • go Alpine 3.14 1.16.15-r0
  • go Alpine 3.15 1.17.9-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.17.7-r0

alpine advisories ALPINE-CVE-2022-23772

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.17.8-1

azure linux advisories AZL-8512

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23772 updated cvss 7.5

golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString

  • Red Hat Migration Toolkit for Containers cpma, rhmtc/openshift-migration-velero-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, servicemesh-pilot-agent, +2 more
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 faq, runc, cri-o, podman, skopeo, cri-tools, +13 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Data Foundation 4 noobaa-operator-container Red Hat OpenShift distributed tracing 2 rhosdt/opentelemetry-rhel8-operator
    affected: no fix available
  • Red Hat OpenShift Virtualization 2 kubevirt, kubemacpool-container, bridge-marker-container, virt-launcher-container, ovs-cni-marker-container, ovs-cni-plugin-container, +12 more
    affected: no fix planned “Out of support scope”
show 18 more
  • Red Hat OpenShift Virtualization 4 kubevirt, cnvnetworking-plugins-rhel9, kubevirt-velero-plugin-container, hostpath-provisioner/hostpath-provisioner, container-native-virtualization/kubemacpool, container-native-virtualization/bridge-marker, +10 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 13 (Queens) qpid-proton, qpid-proton-c, qpid-proton-cpp, qpid-proton-tests, python-qpid-proton
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.1 etcd, qpid-proton-c, golang-qpid-apache, python3-qpid-proton Red Hat OpenStack Platform 16.2 etcd, qpid-proton-c, golang-qpid-apache, python3-qpid-proton, rhosp-rhel8/osp-director-operator, osp-director-provisioner-container
    affected: no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-rhel8, quay/clair-rhel8, quay/quay-builder-rhel8, quay/quay-operator-rhel8, quay/quay-openshift-bridge-rhel8-operator, quay/quay-container-security-operator-rhel8
    affected: no fix available
  • Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8 Red Hat Service Telemetry Framework 1.4 for RHEL 8 stf/sg-core-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat CNV 4.11 for RHEL 8 container-native-virtualization/hostpath-csi-driver v4.11.0-21, container-native-virtualization/hostpath-csi-driver-rhel8 v4.11.0-21
    fixed: vendor fix RHSA-2022:6526
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virt-api v4.12.0-255, container-native-virtualization/virt-operator v4.12.0-255, container-native-virtualization/virt-controller v4.12.0-255, container-native-virtualization/libguestfs-tools v4.12.0-255, container-native-virtualization/virt-artifacts-server v4.12.0-255
    fixed: vendor fix RHSA-2023:0408
  • Red Hat OpenShift Service Mesh 2.1 servicemesh 2.1.3-1.el8, servicemesh-cni 2.1.3-1.el8, servicemesh-proxy 2.1.3-1.el8, servicemesh-operator 2.1.3-2.el8, servicemesh-ratelimit 2.1.3-1.el8, servicemesh-proxy-wasm 2.1.3-1.el8, +3 more
    fixed: vendor fix RHSA-2022:5004
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.7.2-1.module+el8.6.0+12972+ebab5911, golang 1.17.7-1.module+el8.6.0+14297+32a15e19, go-toolset 1.17.7-1.module+el8.6.0+14297+32a15e19, golang-bin 1.17.7-1.module+el8.6.0+14297+32a15e19, golang-src 1.17.7-1.module+el8.6.0+14297+32a15e19, golang-misc 1.17.7-1.module+el8.6.0+14297+32a15e19, +2 more
    fixed: vendor fix RHSA-2022:1819
  • Red Hat OpenShift Container Platform 4.10 openshift4/ose-cli v4.10.0-202207192148.p0.g45460a5.assembly.stream, openshift4/ose-pod v4.10.0-202207192148.p0.g012e945.assembly.stream, openshift4/ose-tests v4.10.0-202207200913.p0.g4e11d23.assembly.stream, openshift4/ose-console v4.10.0-202207211747.p0.g13ec70a.assembly.stream, openshift4/ose-coredns v4.10.0-202207192148.p0.g3ec1ee7.assembly.stream, openshift4/ose-grafana v4.10.0-202207192148.p0.g48aec35.assembly.stream, +148 more
    fixed: vendor fix RHSA-2022:5730
  • Red Hat OpenShift Container Platform 4.11 butane 0.15.0-1.rhaos4.11.el8, buildah 1.23.4-3.rhaos4.11.el8, ignition 2.14.0-3.rhaos4.11.el8, buildah-tests 1.23.4-3.rhaos4.11.el8, ignition-validate 2.14.0-3.rhaos4.11.el8, butane-redistributable 0.15.0-1.rhaos4.11.el8, +2 more
    fixed: vendor fix RHSA-2023:3914
  • Red Hat OpenShift Container Platform 4.14 openshift 4.14.0-202409041843.p0.g03a907c.assembly.stream.el8, openshift 4.14.0-202409041843.p0.g03a907c.assembly.stream.el9, openshift-hyperkube 4.14.0-202409041843.p0.g03a907c.assembly.stream.el8, openshift-hyperkube 4.14.0-202409041843.p0.g03a907c.assembly.stream.el9
    fixed: vendor fix RHSA-2024:6412
  • Red Hat OpenShift Container Platform 4.15 openshift 4.15.0-202408131909.p0.gbc3c7c5.assembly.stream.el8, openshift 4.15.0-202408131909.p0.gbc3c7c5.assembly.stream.el9, openshift-hyperkube 4.15.0-202408131909.p0.gbc3c7c5.assembly.stream.el8, openshift-hyperkube 4.15.0-202408131909.p0.gbc3c7c5.assembly.stream.el9
    fixed: vendor fix RHSA-2024:5754
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.1.0-3.el8
    fixed: vendor fix RHSA-2022:4860
  • Red Hat OpenShift Serverless 1.22 openshift-serverless-1/client-kn-rhel8 1.1.0-4, openshift-serverless-1/serving-queue-rhel8 1.1.2-3, openshift-serverless-1/eventing-mtping-rhel8 1.1.0-3, openshift-serverless-1/kourier-control-rhel8 1.1.0-3, openshift-serverless-1/serving-webhook-rhel8 1.1.2-3, openshift-serverless-1/eventing-webhook-rhel8 1.1.0-3, +32 more
    fixed: vendor fix RHSA-2022:4863
  • Red Hat RHODF 4.11 for RHEL 8 mcg 5.11.0-22.el8, odf4/cephcsi-rhel8 v4.11.0-45, odf4/mcg-core-rhel8 v4.11.0-30, mcg-redistributable 5.11.0-22.el8, odf4/ocs-rhel8-operator v4.11.0-67, odf4/ocs-must-gather-rhel8 v4.11.0-66, +3 more
    fixed: vendor fix RHSA-2022:6155
  • Red Hat Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8 5.1.1-2
    fixed: vendor fix RHSA-2023:1529
  • Red Hat CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework v4.11.0-67, container-native-virtualization/kubevirt-console-plugin v4.11.0-83, container-native-virtualization/vm-network-latency-checkup v4.11.0-67, container-native-virtualization/kubevirt-tekton-tasks-operator v4.11.0-29, container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm v4.11.0-7, container-native-virtualization/kubevirt-tekton-tasks-copy-template v4.11.0-7, +6 more Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virtio-win v4.12.0-10, container-native-virtualization/kubemacpool v4.12.0-24, container-native-virtualization/bridge-marker v4.12.0-24, container-native-virtualization/virt-handler v4.12.0-255, container-native-virtualization/ovs-cni-marker v4.12.0-24, container-native-virtualization/ovs-cni-plugin v4.12.0-24, +32 more Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 pysnmp 4.4.8-3.el8, pyparsing 2.3.1-2.el8, libsodium 1.0.16-5.el8, python-pbr 5.5.1-2.el8, python-yappi 1.0-3.el8, python-amqp 2.5.2-8.el8, +273 more Red Hat Enterprise Linux 9 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more Red Hat OpenShift Container Platform 4 containernetworking-plugins Red Hat OpenShift Container Platform 4.10 openshift4/ose-etcd v4.10.0-202207192148.p0.g7afa17c.assembly.stream, openshift4/ose-deployer v4.10.0-202207192148.p0.g45460a5.assembly.stream, openshift4/ose-tools-rhel8 v4.10.0-202207192148.p0.g45460a5.assembly.stream, openshift4/ose-ironic-rhel8 v4.10.0-202207241436.p0.g62012c2.assembly.stream, openshift4/ose-cli-alt-rhel8 v4.10.0-202207192148.p0.g45460a5.assembly.stream, openshift4/ose-haproxy-router v4.10.0-202207192148.p0.g11109e4.assembly.stream, +12 more
    +2 more products
    Red Hat OpenShift Container Platform 4.11 buildah 1.23.4-2.el8, haproxy 2.2.24-1.el8, haproxy22 2.2.24-1.el8, cri-tools 1.24.2-4.1.el8, crit 3.15-4.rhaos4.11.el8, criu 3.15-4.rhaos4.11.el8, +78 more Red Hat OpenShift Container Platform 4.14 haproxy 2.6.13-4.rhaos4.14.el8, haproxy26 2.6.13-4.rhaos4.14.el8, cri-o 1.27.8-6.rhaos4.14.git06fccaa.el8, cri-o 1.27.8-6.rhaos4.14.git06fccaa.el9, openshift-ansible 4.14.0-202408291409.p0.g0a97acb.assembly.stream.el8, openshift-ansible 4.14.0-202408291409.p0.g0a97acb.assembly.stream.el9, +4 more
    not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.81% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.16.14
>=1.17.0, <1.17.7
1.16.14
1.17.7
go stdlib
<1.16.14
>=1.17.0-0, <1.17.7
1.16.14
1.17.7

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.