Skip to content
Fencer Vulns
high 7.5

CVE-2023-24537 json

Infinite loop in parsing in go/scanner

published 2023-04-05 3 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-24537 , EUVD-2023-28553 , GO-2023-1702

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Patch / fix

  • bitnami golang 1.19.8, 1.20.3
  • go stdlib 1.19.8, 1.20.3
  • Go standard library go/scanner 1.19.8, 1.20.3
  • golang-1.19 Debian 12 1.19.8-2

debian advisories DEBIAN-CVE-2023-24537

  • golang-1.13 Ubuntu 20.04 LTS 1.13.8-1ubuntu1.2
  • golang-1.13 Ubuntu 22.04 LTS 1.13.8-1ubuntu2.22.04.2
  • golang-1.16 Ubuntu 20.04 LTS 1.16.2-0ubuntu1~20.04.1
  • golang-1.18 Ubuntu 18.04 LTS 1.18.1-1ubuntu1~18.04.4
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.2
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.1
  • golang-1.13 Ubuntu Pro 16.04 LTS 1.13.8-1ubuntu1~16.04.3+esm3
  • golang-1.13 Ubuntu Pro 18.04 LTS 1.13.8-1ubuntu1~18.04.4+esm1

ubuntu advisories UBUNTU-CVE-2023-24537

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
  • criu RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
  • crun RHEL 8 1.8.3-1.module+el8.9.0+19098+6e7a5e3f
  • runc RHEL 8 1:1.1.5-2.module+el8.9.0+19104+fcef53a3
  • udica RHEL 8 0.2.6-4.module+el8.9.0+19098+6e7a5e3f
  • conmon RHEL 8 2:2.1.4-2.module+el8.9.0+19098+6e7a5e3f
  • podman RHEL 8 2:4.0.2-24.module+el8.9.0+19784+443be299
  • skopeo RHEL 8 2:1.6.2-8.module+el8.9.0+19104+fcef53a3

red hat advisories RHSA-2023:6938RHSA-2023:6939RHSA-2023:3319RHSA-2023:5964RHSA-2023:6474RHSA-2023:6363

  • go1.19 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +5 more 1.19.9-150000.1.31.1
  • go1.20 SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.4 1.20.4-150000.1.11.1
  • go1.19 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +5 more 1.19.8-150000.1.26.1
  • go1.20 SLE Module for Development Tools 15 SP4, openSUSE Leap 15.4 1.20.3-150000.1.8.1

suse advisories SUSE-SU-2023:2127-1SUSE-SU-2023:2105-2SUSE-SU-2023:2105-1SUSE-SU-2023:1792-1SUSE-SU-2023:1791-1

  • go1.20 openSUSE Tumbleweed 1.20.3-1.1
  • go1.19 openSUSE Tumbleweed 1.19.8-1.1

opensuse advisories openSUSE-SU-2024:12841-1openSUSE-SU-2024:12845-1

  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.3-1.module_el8.9.0+3627+db8ec155
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
  • udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
  • conmon AlmaLinux 8 2:2.1.4-2.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2023:6938ALSA-2023:6939ALSA-2023:6363ALSA-2023:6474

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • crun Rocky Linux 8 1.8.3-1.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • podman Rocky Linux 8 2:4.0.2-24.module+el8.9.0+1445+07728297
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2023:6938RLSA-2023:6939

  • go Alpine 3.17 1.19.8-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.20.3-r0

alpine advisories ALPINE-CVE-2023-24537

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0, Azure Linux 3.0 1.20.7-1
  • msft-golang CBL-Mariner 2.0 1.20.11-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-26026AZL-26029AZL-37319AZL-37352AZL-52676

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-24537 updated cvss 7.5

golang: go/parser: Infinite loop in parsing

  • Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel8-operator Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator
    affected: workaround, no fix available “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat OpenShift Developer Tools and Services odo, helm, ocp-tools-4/jenkins-rhel8
    affected: workaround, no fix available, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: workaround, no fix available “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container
    affected: workaround, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator Red Hat Advanced Cluster Management for Kubernetes 2 thanos-contain Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat AMQ Broker 7 ansible-automation-platform-24/controller-rhel8-operator Red Hat Ansible Automation Platform 2 receptor Red Hat Application Interconnect 1.0 skupper-cli
    affected: workaround, no fix available “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: workaround, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: workaround, no fix available “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat Enterprise Linux 8 podman, skopeo, buildah, grafana, grafana-loki, podman-tests, +21 more
    affected: workaround, no fix available, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
show 20 more
  • Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift Container Platform 4 butane, ignition, ignition-validate, butane-redistributable
    affected: workaround, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8
    affected: workaround, no fix available “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8
    affected: workaround, no fix available, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat OpenShift on AWS rosa Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    affected: workaround, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat OpenShift Virtualization 4 kubevirt
    affected: workaround, no fix available “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat OpenStack Platform 17.0 collectd-libpod-stats, golang-github-infrawatch-apputils Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +3 more
    affected: workaround, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat Web Terminal web-terminal-exec-container Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: workaround, no fix available “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat Service Telemetry Framework 1.4 for RHEL 8 stf/sg-core-rhel8
    affected: workaround, no fix planned “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.”
  • Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.13.3--2023-117063, container-native-virtualization/kubevirt-dpdk-checkup-rhel9 v4.13.3--2023-117063, container-native-virtualization/kubevirt-ssp-operator-rhel9 v4.13.3--2023-117063, container-native-virtualization/kubevirt-console-plugin-rhel9 v4.13.3--2023-117063, container-native-virtualization/kubevirt-template-validator-rhel9 v4.13.3--2023-117063, container-native-virtualization/kubevirt-tekton-tasks-operator-rhel9 v4.13.3--2023-117063, +8 more
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:4664
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 2.3.0-5, cryostat-tech-preview/jfr-datasource-rhel8 2.3.0-5, cryostat-tech-preview/cryostat-reports-rhel8 2.3.0-5, cryostat-tech-preview/cryostat-rhel8-operator 2.3.0-5, cryostat-tech-preview/cryostat-operator-bundle 2.3.0-5, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8 2.3.0-5
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:3167
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 python-flask 2.0.1-4.el9.2, python3-flask 2.0.1-4.el9.2, openstack-ironic 21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-api 21.3.1-0.20230510075528.b3c902e.el9, python3-ironic-tests 21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-common 21.3.1-0.20230510075528.b3c902e.el9, +2 more
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:3366
  • Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8-operator 7.12.0-16, amq7/amq-broker-rhel8-operator-bundle 7.12.0-10
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2024:2944
  • Red Hat Migration Toolkit for Virtualization 2.4 migration-toolkit-virtualization/mtv-controller-rhel9 2.4.3-5
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHBA-2023:6109
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-hub-rhel9 6.2.0-16
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:4627
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.5-3
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:3918
  • Red Hat OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.1-30
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:4657
  • Red Hat Quay v3 quay/clair-rhel8 v3.8.11-3, quay/quay-rhel8 v3.8.11-13, quay/quay-builder-rhel8 v3.8.11-4, quay/quay-operator-rhel8 v3.8.11-3, quay/quay-operator-bundle v3.8.11-20, quay/quay-bridge-operator-rhel8 v3.8.11-3, +4 more
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHBA-2023:4275
  • Red Hat Ansible Automation Platform 2.3 for RHEL 8 openshift-clients 4.12.0-202307200611.p0.g49844f7.assembly.stream.el8
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:4470
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang 1.19.9-1.el7_9, go-toolset-1.19-golang-bin 1.19.9-1.el7_9, go-toolset-1.19-golang-src 1.19.9-1.el7_9, go-toolset-1.19-golang-misc 1.19.9-1.el7_9, go-toolset-1.19-golang-race 1.19.9-1.el7_9, go-toolset-1.19-golang-tests 1.19.9-1.el7_9 Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang 1.19.9-1.el7_9, go-toolset-1.19-golang-bin 1.19.9-1.el7_9, go-toolset-1.19-golang-src 1.19.9-1.el7_9, go-toolset-1.19-golang-misc 1.19.9-1.el7_9, go-toolset-1.19-golang-race 1.19.9-1.el7_9, go-toolset-1.19-golang-tests 1.19.9-1.el7_9
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:3323
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.15-3.module+el8.9.0+19243+df4d9ff2, crit 3.18-4.module+el8.9.0+19090+d2921118, criu 3.15-3.module+el8.9.0+19243+df4d9ff2, criu 3.18-4.module+el8.9.0+19090+d2921118, crun 1.8.3-1.module+el8.9.0+19098+6e7a5e3f, crun 1.8.7-1.module+el8.9.0+19731+94cfa27e, +68 more
    fixed: vendor fix “To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.” RHSA-2023:3319

9 more fixed, 23 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

1.41% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.19.8
>=1.20.0, <1.20.3
1.19.8
1.20.3
go stdlib
<1.19.8
>=1.20.0-0, <1.20.3
1.19.8
1.20.3

Affected products

  • Go standard library go/scanner

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.