Not rated
CVE-2022-30632 Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic…
Description
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| path/filepath 1.18 | 1.18.0-0 → < 1.18.4 | 1.18.4 |
| path/filepath 1.17 | earliest → < 1.17.12 | 1.17.12 |
References
- go.dev go.dev
- go.googlesource.com go.googlesource.com
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of path/filepath
The 6 CVEs of path/filepath →
CVE-2024-8244
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions…
3.7
Low
CVE-2023-45284
On Windows, The IsLocal function does not correctly detect reserved device names in some cases
5.3
Medium
CVE-2023-45283
The filepath package does not recognize paths with a \??\ prefix as special
Not rated
CVE-2022-41722
A path traversal vulnerability exists in filepath.Clean on Windows
Not rated