RHSA-2023%3A1174 — Vulnetix

RHSA-2023%3A1174 PUBLISHED CVSS 6.5 MEDIUM

A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panic.

Risk Scores

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

…and 54 more

Timeline

Mar 9, 2023 CVE Published
Apr 25, 2026 Distribution Patch
Apr 25, 2026 Distribution Patch
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
May 9, 2026 CVE Updated

References

https://access.redhat.com/errata/RHSA-2023:1174 advisory
https://access.redhat.com/security/updates/classification/#moderate advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2132867 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2132868 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2132872 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2161274 issue
https://issues.redhat.com/browse/OADP-1056 advisory
https://issues.redhat.com/browse/OADP-1150 advisory
https://issues.redhat.com/browse/OADP-1217 advisory
https://issues.redhat.com/browse/OADP-1256 advisory
https://issues.redhat.com/browse/OADP-1289 advisory
https://issues.redhat.com/browse/OADP-290 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1174.json advisory
https://access.redhat.com/security/cve/CVE-2022-2879 advisory
https://www.cve.org/CVERecord?id=CVE-2022-2879 advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2879 advisory
https://github.com/golang/go/issues/54853 advisory
https://github.com/vbatts/tar-split/releases/tag/v0.12.1 advisory
https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1 advisory
https://access.redhat.com/security/cve/CVE-2022-2880 advisory

…and 15 more

Open in Interactive Console →

Vendor	Product	Versions
Red Hat	oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:000c106d6f3df71a7bfe7f4dab2705eae66075f47ae9a79cdbe9b7c092a7f969_amd64 as a component of 8Base-OADP-1.1	oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:000c106d6f3df71a7bfe7f4dab2705eae66075f47ae9a79cdbe9b7c092a7f969_amd64, oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:000c106d6f3df71a7bfe7f4dab2705eae66075f47ae9a79cdbe9b7c092a7f969_amd64, *
Red Hat	oadp/oadp-volume-snapshot-mover-rhel8@sha256:be374c3070caf23563762952b8b181721f3869761fc837ee9b5d67d317031169_amd64 as a component of 8Base-OADP-1.1	oadp/oadp-volume-snapshot-mover-rhel8@sha256:be374c3070caf23563762952b8b181721f3869761fc837ee9b5d67d317031169_amd64, *
Red Hat	oadp/oadp-mustgather-rhel8@sha256:1d7f1f396fe68805c144d1a538ba464f5a1efaa8cb09c9069cdbf69a6bb77c6f_s390x as a component of 8Base-OADP-1.1	*, oadp/oadp-mustgather-rhel8@sha256:1d7f1f396fe68805c144d1a538ba464f5a1efaa8cb09c9069cdbf69a6bb77c6f_s390x, oadp/oadp-mustgather-rhel8@sha256:1d7f1f396fe68805c144d1a538ba464f5a1efaa8cb09c9069cdbf69a6bb77c6f_s390x
Red Hat	oadp/oadp-velero-plugin-rhel8@sha256:34af5f104eb6bf621eb85eb91adea036f738eba6a343dbb1b8e10f529461f152_s390x as a component of 8Base-OADP-1.1	oadp/oadp-velero-plugin-rhel8@sha256:34af5f104eb6bf621eb85eb91adea036f738eba6a343dbb1b8e10f529461f152_s390x, *, oadp/oadp-velero-plugin-rhel8@sha256:34af5f104eb6bf621eb85eb91adea036f738eba6a343dbb1b8e10f529461f152_s390x
Red Hat	oadp/oadp-velero-plugin-for-csi-rhel8@sha256:6647c6226f0d688aa0509bf3975c9c5cf7fb36ca19fa79e33e37ff97598ed7f5_ppc64le as a component of 8Base-OADP-1.1	oadp/oadp-velero-plugin-for-csi-rhel8@sha256:6647c6226f0d688aa0509bf3975c9c5cf7fb36ca19fa79e33e37ff97598ed7f5_ppc64le, *
Red Hat	oadp/oadp-velero-rhel8@sha256:d472102becfa09546580fd54704e2b1556398c5d0a0362a99fc108debff6954d_s390x as a component of 8Base-OADP-1.1	oadp/oadp-velero-rhel8@sha256:d472102becfa09546580fd54704e2b1556398c5d0a0362a99fc108debff6954d_s390x, oadp/oadp-velero-rhel8@sha256:d472102becfa09546580fd54704e2b1556398c5d0a0362a99fc108debff6954d_s390x
Red Hat	oadp/oadp-volume-snapshot-mover-rhel8@sha256:225b98dba7f2f210b4684f256b5abf2058e7d45db64f0bc7f46891832fc11315_s390x as a component of 8Base-OADP-1.1	oadp/oadp-volume-snapshot-mover-rhel8@sha256:225b98dba7f2f210b4684f256b5abf2058e7d45db64f0bc7f46891832fc11315_s390x, oadp/oadp-volume-snapshot-mover-rhel8@sha256:225b98dba7f2f210b4684f256b5abf2058e7d45db64f0bc7f46891832fc11315_s390x, *
Red Hat	oadp/oadp-volume-snapshot-mover-rhel8@sha256:be374c3070caf23563762952b8b181721f3869761fc837ee9b5d67d317031169_amd64 as a component of 8Base-OADP-1.1	oadp/oadp-volume-snapshot-mover-rhel8@sha256:be374c3070caf23563762952b8b181721f3869761fc837ee9b5d67d317031169_amd64, oadp/oadp-volume-snapshot-mover-rhel8@sha256:be374c3070caf23563762952b8b181721f3869761fc837ee9b5d67d317031169_amd64, *
Red Hat	oadp/oadp-velero-plugin-for-aws-rhel8@sha256:60b69812981b289b5e7e3052ceb2d5a7c0c14a9353aed10ad8f3da89f0674079_amd64 as a component of 8Base-OADP-1.1	oadp/oadp-velero-plugin-for-aws-rhel8@sha256:60b69812981b289b5e7e3052ceb2d5a7c0c14a9353aed10ad8f3da89f0674079_amd64, *, oadp/oadp-velero-plugin-for-aws-rhel8@sha256:60b69812981b289b5e7e3052ceb2d5a7c0c14a9353aed10ad8f3da89f0674079_amd64
Red Hat	oadp/oadp-mustgather-rhel8@sha256:1d7f1f396fe68805c144d1a538ba464f5a1efaa8cb09c9069cdbf69a6bb77c6f_s390x as a component of 8Base-OADP-1.1	,
Red Hat	oadp/oadp-volume-snapshot-mover-rhel8@sha256:97068c64c6eb54a26f665eeac2ff0b4e23ec97b6421044cbaa31093e9b797b62_ppc64le as a component of 8Base-OADP-1.1	, oadp/oadp-volume-snapshot-mover-rhel8@sha256:97068c64c6eb54a26f665eeac2ff0b4e23ec97b6421044cbaa31093e9b797b62_ppc64le,

Red Hat	oadp/oadp-rhel8-operator@sha256:dcddfcc46a0c0a904fc0b444bbc4dbd8f04bf577d5a7be49524cb0b52b2a0abe_ppc64le as a component of 8Base-OADP-1.1	*, oadp/oadp-rhel8-operator@sha256:dcddfcc46a0c0a904fc0b444bbc4dbd8f04bf577d5a7be49524cb0b52b2a0abe_ppc64le
Red Hat	oadp/oadp-velero-plugin-for-csi-rhel8@sha256:fbde2697cb2e57aa7d6655534c3677c5fc86b19710a7b870f1c6b9003033b4e8_amd64 as a component of 8Base-OADP-1.1	oadp/oadp-velero-plugin-for-csi-rhel8@sha256:fbde2697cb2e57aa7d6655534c3677c5fc86b19710a7b870f1c6b9003033b4e8_amd64, oadp/oadp-velero-plugin-for-csi-rhel8@sha256:fbde2697cb2e57aa7d6655534c3677c5fc86b19710a7b870f1c6b9003033b4e8_amd64, *
Red Hat	oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3548d98637c8573c036e28121f61c3429d5061cb32a193eb71394b2103089c6d_amd64 as a component of 8Base-OADP-1.1	, , *
Red Hat	oadp/oadp-mustgather-rhel8@sha256:ee2a7436fe117ae745c721cabd51c2779a0c1d6b2f67c2b3b7ee182c17a74061_ppc64le as a component of 8Base-OADP-1.1	*, oadp/oadp-mustgather-rhel8@sha256:ee2a7436fe117ae745c721cabd51c2779a0c1d6b2f67c2b3b7ee182c17a74061_ppc64le, oadp/oadp-mustgather-rhel8@sha256:ee2a7436fe117ae745c721cabd51c2779a0c1d6b2f67c2b3b7ee182c17a74061_ppc64le
Red Hat	oadp/oadp-mustgather-rhel8@sha256:ee2a7436fe117ae745c721cabd51c2779a0c1d6b2f67c2b3b7ee182c17a74061_ppc64le as a component of 8Base-OADP-1.1	oadp/oadp-mustgather-rhel8@sha256:ee2a7436fe117ae745c721cabd51c2779a0c1d6b2f67c2b3b7ee182c17a74061_ppc64le, oadp/oadp-mustgather-rhel8@sha256:ee2a7436fe117ae745c721cabd51c2779a0c1d6b2f67c2b3b7ee182c17a74061_ppc64le
Red Hat	oadp/oadp-velero-restic-restore-helper-rhel8@sha256:021392da75c14255a6381a1ace934f7a546de5dccd38ab8a8bdc43a45b4fd7eb_ppc64le as a component of 8Base-OADP-1.1	oadp/oadp-velero-restic-restore-helper-rhel8@sha256:021392da75c14255a6381a1ace934f7a546de5dccd38ab8a8bdc43a45b4fd7eb_ppc64le, oadp/oadp-velero-restic-restore-helper-rhel8@sha256:021392da75c14255a6381a1ace934f7a546de5dccd38ab8a8bdc43a45b4fd7eb_ppc64le
Red Hat	oadp/oadp-rhel8-operator@sha256:7fa56d2a84a3be27d149e624be0385590e6b2193974373b2c829b322e28e270b_s390x as a component of 8Base-OADP-1.1	oadp/oadp-rhel8-operator@sha256:7fa56d2a84a3be27d149e624be0385590e6b2193974373b2c829b322e28e270b_s390x, *, oadp/oadp-rhel8-operator@sha256:7fa56d2a84a3be27d149e624be0385590e6b2193974373b2c829b322e28e270b_s390x
Red Hat	oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:000c106d6f3df71a7bfe7f4dab2705eae66075f47ae9a79cdbe9b7c092a7f969_amd64 as a component of 8Base-OADP-1.1	*, oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:000c106d6f3df71a7bfe7f4dab2705eae66075f47ae9a79cdbe9b7c092a7f969_amd64