GO-2024-3106 | Vulnetix

GO-2024-3106 PUBLISHED

Record from OSV · Published September 6, 2024

Stack exhaustion in Decoder.Decode in encoding/gob

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
yq-fips	Chainguard	4.44.3-r1
mc-fips	Chainguard	0.20240131.085940-r10
gomplate-fips	Chainguard	4.1.0-r2
azure-aad-pod-identity-mic	Chainguard	1.8.17-r12
kyverno-policy-reporter-kyverno-plugin	Chainguard	1.6.4-r1
atlantis	Wolfi	0.29.0-r1
buildkitd	Chainguard	0.20.1-r3
dynamic-localpv-provisioner	Chainguard	4.1.0-r1
glow	Wolfi	2.0.0-r1
gomplate	Chainguard	4.1.0-r2
grype	Wolfi	0.80.1-r0
fzf	Chainguard	0.55.0-r1

88 more packages have a fixed version. See every fix in Lookup.

Vendor	Product	Versions
chainguard	yq-fips	0
chainguard	mc-fips	0
chainguard	gomplate-fips	0
chainguard	azure-aad-pod-identity-mic	0
chainguard	kyverno-policy-reporter-kyverno-plugin	0
wolfi	atlantis	0
chainguard	buildkitd	0
chainguard	dynamic-localpv-provisioner	0
wolfi	glow	0
chainguard	gomplate	0
wolfi	grype	0
chainguard	fzf	0
chainguard	oauth2-proxy	0
chainguard	temporal	0
chainguard	osv-scanner	0
chainguard	lazygit	0
wolfi	kaf	0
wolfi	whereabouts	0
wolfi	redka	0
chainguard	aws-ebs-csi-driver	0

…and 1068 more

The same record, from the CLI:

vulnetix vdb vuln GO-2024-3106
vulnetix vdb fixes GO-2024-3106

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2024-3106/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart