Skip to content
Fencer Vulns
high 7.5

CVE-2022-30631 json

Stack exhaustion when reading certain archives in compress/gzip

published 2022-07-20 4 y ago modified 2026-09-08 2 mo ago also BIT-golang-2022-30631 , EUVD-2022-52462 , GO-2022-0524

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Patch / fix

  • bitnami golang 1.17.12, 1.18.4
  • go stdlib 1.17.12, 1.18.4
  • Go standard library compress/gzip 1.17.12, 1.18.4
  • golang-1.19 Debian 12 1.19~rc2-1

debian advisories DEBIAN-CVE-2022-30631

  • golang-1.13 Ubuntu 20.04 LTS 1.13.8-1ubuntu1.2
  • golang-1.13 Ubuntu 22.04 LTS 1.13.8-1ubuntu2.22.04.2
  • golang-1.16 Ubuntu 20.04 LTS 1.16.2-0ubuntu1~20.04.1
  • golang-1.18 Ubuntu 18.04 LTS 1.18.1-1ubuntu1~18.04.4
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.2
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.1
  • golang-1.13 Ubuntu Pro 16.04 LTS 1.13.8-1ubuntu1~16.04.3+esm3
  • golang-1.13 Ubuntu Pro 18.04 LTS 1.13.8-1ubuntu1~18.04.4+esm1

ubuntu advisories UBUNTU-CVE-2022-30631

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-3.module+el8.8.0+17821+de1b53f1
  • criu RHEL 8 3.15-3.module+el8.8.0+17821+de1b53f1
  • crun RHEL 8 1.6-1.module+el8.8.0+17821+de1b53f1
  • runc RHEL 8 1:1.1.4-1.module+el8.8.0+17821+de1b53f1
  • udica RHEL 8 0.2.6-3.module+el8.8.0+17821+de1b53f1
  • conmon RHEL 8 2:2.1.4-1.module+el8.8.0+17821+de1b53f1
  • podman RHEL 8 2:4.0.2-20.module+el8.8.0+18201+6ad7332c
  • skopeo RHEL 8 2:1.6.2-6.module+el8.8.0+17821+de1b53f1

red hat advisories RHSA-2023:2802RHSA-2023:2758RHSA-2022:7529RHSA-2022:5775RHSA-2024:2180RHSA-2023:0727

  • go1.18-openssl SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +6 more 1.18.10.1-150000.1.9.1
  • go1.18 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.18.5-150000.1.25.1
  • go1.17 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +10 more 1.17.13-150000.1.42.1

suse advisories SUSE-SU-2023:2312-1SUSE-SU-2022:2672-1SUSE-SU-2022:2671-1

  • go1.17 openSUSE Tumbleweed 1.17.12-1.1
  • go1.18 openSUSE Tumbleweed 1.18.4-1.1

opensuse advisories openSUSE-SU-2024:12189-1openSUSE-SU-2024:12190-1

  • runc AlmaLinux 9 4:1.1.12-2.el9
  • crit AlmaLinux 8 3.15-3.module_el8.7.0+3407+95aa0ca9
  • criu AlmaLinux 8 3.15-3.module_el8.7.0+3407+95aa0ca9
  • crun AlmaLinux 8 1.8.1-2.module_el8.8.0+3568+e8578284
  • runc AlmaLinux 8 1:1.1.4-1.module_el8.7.0+3407+95aa0ca9
  • udica AlmaLinux 8 0.2.6-20.module_el8.8.0+3470+252b1910
  • conmon AlmaLinux 8 3:2.1.6-1.module_el8.8.0+3470+252b1910
  • podman AlmaLinux 8 3:4.4.1-8.module_el8.8.0+3568+e8578284

almalinux advisories ALSA-2024:2180ALSA-2023:2758ALSA-2023:2802ALSA-2022:8057ALSA-2022:8098ALSA-2022:8250

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
  • cockpit-podman Rocky Linux 8 46-1.module+el8.9.0+1445+07728297
  • oci-seccomp-bpf-hook Rocky Linux 8 1.2.5-2.module+el8.9.0+1445+07728297
  • grafana-pcp Rocky Linux 9 3.2.0-3.el9
  • toolbox Rocky Linux 9 0.0.99.3-5.el9.rocky.0.1
  • grafana Rocky Linux 9 7.5.15-3.el9
  • grafana-pcp Rocky Linux 8 3.2.0-2.el8

rocky linux advisories RLSA-2023:2758RLSA-2023:2802RLSA-2022:8250RLSA-2022:8098RLSA-2022:8057RLSA-2022:7648

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.18.4-r0

alpine advisories ALPINE-CVE-2022-30631

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.18.5-1

azure linux advisories AZL-10534

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-30631 updated cvss 7.5

golang: compress/gzip: stack exhaustion in Reader.Read

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9, migration-toolkit-virtualization/mtv-must-gather-api-rhel8 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel8-operator Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift API for Data Protection oadp/oadp-registry-rhel8
    affected: no fix available
  • Red Hat OpenShift Developer Tools and Services odo, helm
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: no fix available
  • Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/work-rhel8
    affected: no fix available
  • Red Hat Ansible Automation Platform 2 receptor, openshift-clients
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 5 rhceph/snmp-notifier-rhel8, rhceph/rhceph-5-dashboard-rhel8 Red Hat Enterprise Linux 8 weldr-client, osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 butane, podman, skopeo, buildah, ignition, go-toolset, +17 more
    affected: no fix available
show 21 more
  • Red Hat OpenShift Container Platform 4 faq, openshift, prometheus-promu, openshift-clients, openshift-kubelet, openshift-hyperkube, +8 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-rhel8-operator, rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8 Red Hat OpenShift on AWS rosa Red Hat Quay 3 quay/clair-rhel8 Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +3 more Red Hat Web Terminal web-terminal-exec-container, web-terminal/web-terminal-rhel9-operator
    affected: no fix available
  • Red Hat CNV 4.12 for RHEL 7 kubevirt 4.12.0-1057.el7, kubevirt-virtctl 4.12.0-1057.el7, kubevirt-virtctl-redistributable 4.12.0-1057.el7 Red Hat CNV 4.12 for RHEL 8 kubevirt 4.12.0-1057.el8, kubevirt-virtctl 4.12.0-1057.el8, kubevirt-virtctl-redistributable 4.12.0-1057.el8, container-native-virtualization/virt-api v4.12.0-255
    fixed: vendor fix RHSA-2023:0407
  • Red Hat Node Healthcheck Operator 0.3 for RHEL 8 workload-availability/node-healthcheck-rhel8-operator v0.3.1-1
    fixed: vendor fix RHSA-2022:6187
  • Red Hat Node Maintenance Operator 4.11 for RHEL 8 workload-availability/node-maintenance-rhel8-operator v4.11.1-1
    fixed: vendor fix RHSA-2022:6188
  • Red Hat OpenShift API for Data Protection 1.0 oadp/oadp-velero-rhel8 1.0.4-6
    fixed: vendor fix RHSA-2022:6430
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.0-27, oadp/oadp-rhel8-operator 1.1.0-50, oadp/oadp-mustgather-rhel8 1.1.0-63, oadp/oadp-velero-plugin-rhel8 1.1.0-20, oadp/oadp-velero-plugin-for-aws-rhel8 1.1.0-17, oadp/oadp-velero-plugin-for-csi-rhel8 1.1.0-25, +5 more
    fixed: vendor fix RHSA-2022:6290
  • Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8 2.8.2-143, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator 2.8.2-143
    fixed: vendor fix RHSA-2023:1042
  • Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-266, openshift-logging/elasticsearch-rhel8-operator v5.3.11-8, openshift-logging/log-file-metric-exporter-rhel8 v1.0.0-160
    fixed: vendor fix RHSA-2022:6182
  • Red Hat OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.1-11
    fixed: vendor fix RHSA-2022:6152
  • Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-dashboard-rhel9 6-75
    fixed: vendor fix RHSA-2023:3642
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-golang 1.17.12-1.el7_9, go-toolset-1.17-golang-bin 1.17.12-1.el7_9, go-toolset-1.17-golang-src 1.17.12-1.el7_9, go-toolset-1.17-golang-misc 1.17.12-1.el7_9, go-toolset-1.17-golang-race 1.17.12-1.el7_9, go-toolset-1.17-golang-tests 1.17.12-1.el7_9
    fixed: vendor fix RHSA-2022:5866
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 7.5.15-3.el8, grafana-pcp 3.2.0-2.el8, crun 1.6-1.module+el8.8.0+17821+de1b53f1, crit 3.15-1.module+el8.7.0+16212+65e1b35f, crit 3.15-3.module+el8.8.0+17821+de1b53f1, crit 3.15-3.module+el8.8.0+18060+3f21f2cc, +97 more
    fixed: vendor fix RHSA-2022:5775
  • Red Hat Enterprise Linux AppStream (v. 9) runc 1.1.12-2.el9, grafana 7.5.15-3.el9, golang 1.17.12-1.el9_0, toolbox 0.0.99.3-5.el9, grafana-pcp 3.2.0-3.el9, golang-bin 1.17.12-1.el9_0, +5 more
    fixed: vendor fix RHSA-2022:5799
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-velero-plugin-rhel8 v1.7.4-6, rhmtc/openshift-migration-velero-rhel8 v1.7.4-6, rhmtc/openshift-migration-registry-rhel8 v1.7.4-7, rhmtc/openshift-migration-controller-rhel8 v1.7.4-7, rhmtc/openshift-migration-must-gather-rhel8 v1.7.4-7, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8 v1.7.4-6, +3 more
    fixed: vendor fix RHSA-2022:6429
  • Red Hat OpenShift Container Platform 4.6 redhat/redhat-operator-index v4.6, openshift4/ose-cli v4.6.0-202208241715.p0.gb153f08.assembly.stream, openshift4/ose-pod v4.6.0-202208241715.p0.g618b71d.assembly.stream, openshift4/ose-tests v4.6.0-202208241715.p0.g5d66591.assembly.stream, openshift4/ose-console v4.6.0-202208241715.p0.g8f11b42.assembly.stream, openshift4/ose-coredns v4.6.0-202208241715.p0.g885fb55.assembly.stream, +106 more
    fixed: vendor fix RHSA-2022:6262
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-cli v4.7.0-202208021424.p0.gc4ebc7a.assembly.stream, openshift4/ose-pod v4.7.0-202208021424.p0.g0e45f63.assembly.stream, openshift4/ose-tests v4.7.0-202208021424.p0.g7706ed4.assembly.stream, openshift4/ose-console v4.7.0-202208021424.p0.g330ce5d.assembly.stream, openshift4/ose-coredns v4.7.0-202208021424.p0.gd4a3ba3.assembly.stream, openshift4/ose-grafana v4.7.0-202208021424.p0.gb02c35d.assembly.stream, +116 more
    fixed: vendor fix RHSA-2022:6053
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-cli v4.8.0-202208241844.p0.g3de49cf.assembly.stream, openshift4/ose-pod v4.8.0-202208241844.p0.g31d53a1.assembly.stream, openshift4/ose-tests v4.8.0-202208310055.p0.g2eb8645.assembly.stream, openshift4/ose-console v4.8.0-202208310055.p0.g54ca007.assembly.stream, openshift4/ose-coredns v4.8.0-202208241844.p0.g642b46e.assembly.stream, openshift4/ose-grafana v4.8.0-202208311019.p0.gf98b47f.assembly.stream, +124 more
    fixed: vendor fix RHSA-2022:6308
  • Red Hat OpenShift Container Platform 4.9 openshift4/ose-cli v4.9.0-202208020055.p0.gb49c285.assembly.stream, openshift4/ose-pod v4.9.0-202208020055.p0.g9e95cb9.assembly.stream, openshift4/ose-etcd v4.9.0-202208020055.p0.g9b68298.assembly.stream, openshift4/ose-tests v4.9.0-202208020055.p0.g6ec9a5e.assembly.stream, openshift4/ose-console v4.9.0-202208021435.p0.g43a4326.assembly.stream, openshift4/ose-coredns v4.9.0-202208020055.p0.g3cb11c0.assembly.stream, +135 more
    fixed: vendor fix RHSA-2022:5879
  • Red Hat OpenShift Container Platform 4.10 openshift4/ose-cli v4.10.0-202207291908.p0.ge29d58e.assembly.stream, openshift4/ose-pod v4.10.0-202207291908.p0.g012e945.assembly.stream, openshift4/ose-tests v4.10.0-202207291908.p0.g4e11d23.assembly.stream, openshift4/ose-console v4.10.0-202208021356.p0.gdee1944.assembly.stream, openshift4/ose-coredns v4.10.0-202207291908.p0.g3ec1ee7.assembly.stream, openshift4/ose-grafana v4.10.0-202207291908.p0.g48aec35.assembly.stream, +151 more
    fixed: vendor fix RHSA-2022:5875
  • Red Hat OpenShift Container Platform 4.11 openshift4/ose-cli v4.11.0-202208150437.p0.gfcf512e.assembly.stream, openshift4/ose-pod v4.11.0-202208101756.p0.g4f0dd4d.assembly.stream, openshift4/ose-tests v4.11.0-202208150437.p0.g2137b2b.assembly.stream, openshift4/ose-console v4.11.0-202208110436.p0.g6b10e5b.assembly.stream, openshift4/ose-coredns v4.11.0-202208031306.p0.g7fe212f.assembly.stream, openshift4/ose-grafana v4.11.0-202208031306.p0.g6773185.assembly.stream, +164 more
    fixed: vendor fix RHSA-2022:6103

13 more fixed, 30 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
12 mo ago

Exploit prediction

2.19% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.17.12
>=1.18.0, <1.18.4
1.17.12
1.18.4
go stdlib
<1.17.12
>=1.18.0-0, <1.18.4
1.17.12
1.18.4

Affected products

  • Go standard library compress/gzip

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.