CVE-2022-2879 json
Unbounded memory consumption when reading headers in archive/tar
published 2022-10-06 4 y ago modified 2026-09-08 2 mo ago also BIT-golang-2022-2879 , EUVD-2022-35111 , GO-2022-1037
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Patch / fix
- bitnami golang 1.18.7, 1.19.2
- go stdlib 1.18.7, 1.19.2
- Go standard library archive/tar 1.18.7, 1.19.2
- golang-1.19 Debian 12 1.19.2-1
debian advisories DEBIAN-CVE-2022-2879
- golang-1.13 Ubuntu 20.04 LTS 1.13.8-1ubuntu1.2
- golang-1.13 Ubuntu 22.04 LTS 1.13.8-1ubuntu2.22.04.2
- golang-1.16 Ubuntu 20.04 LTS 1.16.2-0ubuntu1~20.04.1
- golang-1.18 Ubuntu 18.04 LTS 1.18.1-1ubuntu1~18.04.4
- golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.2
- golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.1
- golang-1.13 Ubuntu Pro 16.04 LTS 1.13.8-1ubuntu1~16.04.3+esm3
- golang-1.13 Ubuntu Pro 18.04 LTS 1.13.8-1ubuntu1~18.04.4+esm1
ubuntu advisories UBUNTU-CVE-2022-2879
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- crit RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
- criu RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
- crun RHEL 8 1.14.3-2.module+el8.10.0+21340+c6c7475a
- runc RHEL 8 1:1.1.12-1.module+el8.10.0+21251+62b7388c
- udica RHEL 8 0.2.6-20.module+el8.9.0+20326+387084d0
- conmon RHEL 8 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
- podman RHEL 8 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
- skopeo RHEL 8 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c
red hat advisories RHSA-2024:2988RHSA-2024:0121RHSA-2023:0446RHSA-2023:4003RHSA-2023:3613RHSA-2023:2780
- go1.18-openssl SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +6 more 1.18.10.1-150000.1.9.1
- go1.19 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.19.2-150000.1.12.1
- go1.18 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.18.7-150000.1.34.1
suse advisories SUSE-SU-2023:2312-1SUSE-SU-2022:3669-1SUSE-SU-2022:3668-1
- go1.18 openSUSE Tumbleweed 1.18.7-1.1
- go1.19 openSUSE Tumbleweed 1.19.2-1.1
- docker-compose openSUSE Tumbleweed 2.12.0-1.1
opensuse advisories openSUSE-SU-2024:12391-1openSUSE-SU-2024:12392-1openSUSE-SU-2024:12421-1
- crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
- crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
- criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
- criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
- crun AlmaLinux 8 1.8.7-1.module_el8.9.0+3683+33eb0feb
- runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
- runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3687+dcd7ef8f
- udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
almalinux advisories ALSA-2024:0121ALSA-2023:2780ALSA-2023:2204ALSA-2023:0446ALSA-2023:0328
- criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
- runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
- udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
- conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
- skopeo Rocky Linux 8 2:1.6.2-9.module+el8.9.0+1578+aa900b44
- buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
- libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
- slirp4netns Rocky Linux 8 1.1.8-3.module+el8.9.0+1445+07728297
rocky linux advisories RLSA-2024:0121RLSA-2024:2988RLSA-2023:0446RLSA-2023:0328
- go Alpine 3.16 1.18.7-r0
- go Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 1.19.2-r0
alpine advisories ALPINE-CVE-2022-2879
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- golang CBL-Mariner 2.0 1.19.10-1
- golang CBL-Mariner 2.0 1.21.6-1
- moby-engine Azure Linux 3.0 25.0.3-3
- ig Azure Linux 3.0 0.29.0-1
- libcontainers-common Azure Linux 3.0 20240213-2
- skopeo Azure Linux 3.0 1.14.4-1
- containerized-data-importer Azure Linux 3.0 1.57.0-3
- podman Azure Linux 3.0 5.6.1-2
azure linux advisories AZL-11128AZL-37526AZL-41393AZL-41765AZL-41786AZL-41787
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- go.dev/cl/439355 patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-2879 updated cvss 6.5
golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers
-
Red Hat OpenShift Developer Tools and Services odo, helmaffected: no fix available “Fix deferred”
-
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/prometheus-rhel9 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat AMQ Broker 7 ansible-automation-platform-24/controller-rhel8-operator Red Hat Ansible Automation Platform 2 openshift-clients Red Hat Application Interconnect 1.0 skupper-cliaffected: no fix available
-
Red Hat Ceph Storage 3 golang, golang-bin, golang-srcaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 podman, skopeo, buildah, podman-tests, skopeo-tests, buildah-tests, +7 moreaffected: no fix available, no fix planned “Will not fix”
-
Red Hat Enterprise Linux 9 podman, skopeo, buildah, podman-tests, skopeo-tests, buildah-tests, +5 moreaffected: no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 openshift-golang-builder-container Red Hat Openshift Data Foundation 4 mcg Red Hat Quay 3 quay/clair-rhel8affected: no fix available
-
Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests, go-toolset-7-golangaffected: no fix planned “Out of support scope”
-
Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.13.0--2022-101182, container-native-virtualization/virtio-win-rhel9 v4.13.0--2022-101182, container-native-virtualization/kubemacpool-rhel9 v4.13.0--2022-101182, container-native-virtualization/virt-handler-rhel9 v4.13.0--2022-101182, container-native-virtualization/bridge-marker-rhel9 v4.13.0--2022-101182, container-native-virtualization/multus-dynamic-networks-rhel9 v4.13.0-37, +40 morefixed: vendor fix RHSA-2023:3205
show 18 moreshow fewer
-
Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8-operator 7.12.0-16, amq7/amq-broker-rhel8-operator-bundle 7.12.0-10fixed: vendor fix RHSA-2024:2944
-
Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.2-16fixed: vendor fix RHSA-2023:1174
-
Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8 2.8.2-143fixed: vendor fix RHSA-2023:1042
-
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.18 1.18.9-1.el7_9, go-toolset-1.18-build 1.18.9-1.el7_9, go-toolset-1.18-golang 1.18.9-1.el7_9, go-toolset-1.18-runtime 1.18.9-1.el7_9, go-toolset-1.18-scldevel 1.18.9-1.el7_9, go-toolset-1.18-golang-bin 1.18.9-1.el7_9, +4 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.18 1.18.9-1.el7_9, go-toolset-1.18-build 1.18.9-1.el7_9, go-toolset-1.18-golang 1.18.9-1.el7_9, go-toolset-1.18-runtime 1.18.9-1.el7_9, go-toolset-1.18-scldevel 1.18.9-1.el7_9, go-toolset-1.18-golang-bin 1.18.9-1.el7_9, +4 morefixed: vendor fix RHSA-2023:0445
-
Red Hat Enterprise Linux AppStream (v. 8) weldr-client 35.9-2.el8, osbuild-composer 75-1.el8, osbuild-composer-core 75-1.el8, osbuild-composer-worker 75-1.el8, osbuild-composer-dnf-json 75-1.el8, crit 3.15-3.module+el8.9.0+20656+56f336b9, +73 morefixed: vendor fix RHSA-2024:2988
-
Red Hat Enterprise Linux AppStream (v. 9) golang 1.18.9-1.el9_1, weldr-client 35.9-1.el9, golang-bin 1.18.9-1.el9_1, golang-src 1.18.9-1.el9_1, golang-misc 1.18.9-1.el9_1, golang-race 1.18.9-1.el9_1, +5 morefixed: vendor fix RHSA-2023:0328
-
Red Hat Migration Toolkit 1.7 rhmtc/openshift-velero-plugin-rhel8 v1.7.7-3fixed: vendor fix RHSA-2023:0693
-
Red Hat OpenShift Container Platform 4.11 openshift4/ose-cli v4.11.0-202211072116.p0.g142cb44.assembly.stream, openshift4/ose-pod v4.11.0-202211072116.p0.g5157800.assembly.stream, openshift4/ose-tests v4.11.0-202211072116.p0.gaa67fda.assembly.stream, openshift4/ose-console v4.11.0-202211072116.p0.gb452647.assembly.stream, openshift4/ose-coredns v4.11.0-202211072116.p0.g7fe212f.assembly.stream, openshift4/ose-hyperkube v4.11.0-202211072116.p0.g5157800.assembly.stream, +163 morefixed: vendor fix RHSA-2022:8535
-
Red Hat OpenShift Container Platform 4.12 conmon 2.1.2-4.rhaos4.12.el8, conmon 2.1.2-5.rhaos4.12.el9, podman 4.2.0-7.rhaos4.12.el9, skopeo 1.9.4-3.rhaos4.12.el9, buildah 1.23.4-4.rhaos4.12.el8, buildah 1.23.4-4.rhaos4.12.el9, +189 morefixed: vendor fix RHSA-2023:0727
-
Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.6.1-1.el8fixed: vendor fix RHSA-2023:0708
-
Red Hat OpenShift Serverless 1.27 openshift-serverless-1/client-kn-rhel8 1.6.1-1, openshift-serverless-1/func-utils-rhel8 1.27.0-1, openshift-serverless-1/serving-queue-rhel8 1.6.0-1, openshift-serverless-1/eventing-mtping-rhel8 1.6.0-3, openshift-serverless-1/kourier-control-rhel8 1.6.0-2, openshift-serverless-1/serving-webhook-rhel8 1.6.0-1, +31 morefixed: vendor fix RHSA-2023:0709
-
Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent 1.3.0-6, rhosp-rhel8/osp-director-operator 1.3.0-5, rhosp-rhel8/osp-director-downloader 1.3.0-6, rhosp-rhel8/osp-director-operator-bundle 1.3.0-10fixed: vendor fix RHSA-2023:1079
-
Red Hat Service Interconnect skupper-cli 1.4.1-2.el8 Red Hat Service Interconnect 1 skupper-cli 1.4.1-2.el9fixed: vendor fix RHSA-2023:4003
-
Red Hat RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9 v4.13.0-35, odf4/mcg-rhel9-operator v4.13.0-41fixed: vendor fix RHSA-2023:3742
-
Red Hat RHOL 5.5 for RHEL 8 openshift-logging/logging-loki-rhel8 v2.6.1-23fixed: vendor fix RHSA-2022:8781
-
Red Hat RHOL 5.6 for RHEL 8 openshift-logging/logging-loki-rhel8 v2.7.1-8fixed: vendor fix RHSA-2023:0264
-
Red Hat RHOSSM 2.3 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.3.1-9, openshift-service-mesh/proxyv2-rhel8 2.3.1-11, openshift-service-mesh/istio-cni-rhel8 2.3.1-9, openshift-service-mesh/ratelimit-rhel8 2.3.1-5, openshift-service-mesh/prometheus-rhel8 2.3.1-6, openshift-service-mesh/istio-rhel8-operator 2.3.1-10fixed: vendor fix RHSA-2023:0542
-
Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 tox 3.23.0-2.el9.1, crudini 0.9.3-4.el9, pysnmp 4.4.12-6.el9, future 0.18.2-9.el9.1, subunit 1.4.0-6.el9.1, pyflakes 2.2.0-3.el9.1, +451 more Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8 7.12.0-7, amq7/amq-broker-init-rhel8 7.12.0-7 Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-rhel8-operator 1.1.2-16, oadp/oadp-operator-bundle 1.1.2-31, oadp/oadp-mustgather-rhel8 1.1.2-26, oadp/oadp-velero-plugin-rhel8 1.1.2-13, oadp/oadp-velero-plugin-for-aws-rhel8 1.1.2-13, oadp/oadp-velero-plugin-for-csi-rhel8 1.1.2-13, +5 more Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8 2.8.2-143, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator 2.8.2-143, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-operator-bundle 2.8.2-143 Red Hat Enterprise Linux 9 conmon Red Hat Enterprise Linux AppStream (v. 8) osbuild 81-1.el8, osbuild-lvm2 81-1.el8, osbuild-luks2 81-1.el8, osbuild-ostree 81-1.el8, osbuild-selinux 81-1.el8, python3-osbuild 81-1.el8, +1 morenot affected: vulnerable code not present
+1 more productsfewer
Red Hat Enterprise Linux AppStream (v. 9) osbuild 81-1.el9, osbuild-lvm2 81-1.el9, osbuild-luks2 81-1.el9, osbuild-ostree 81-1.el9, osbuild-selinux 81-1.el9, python3-osbuild 81-1.el9, +2 more
10 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.01% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | golang | <1.18.7 >=1.19.0, <1.19.2 |
1.18.7 1.19.2 |
| go | stdlib | <1.18.7 >=1.19.0-0, <1.19.2 |
1.18.7 1.19.2 |
Affected products
- Go standard library archive/tar
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
go.dev
/cl/439355
patch
-
pkg.go.dev
/vuln/GO-2022-1037
vendor-advisory, advisory
-
go.dev
/issue/54853
issue-tracking, third-party-advisory, advisory, report
-
groups.google.com
/g/golang-announce/c/xtuG5faxtaU
mailing-list, release-notes, discussion, web
-
security.gentoo.org
/glsa/202311-09
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-2879
web
Sources
- CVE List CVE-2022-2879
- NVD CVE-2022-2879
- OSV BIT-golang-2022-2879
- OSV GO-2022-1037
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.