VDB

RHSA-2023%3A3205

RHSA-2023%3A3205 PUBLISHED CVSS 6.5 MEDIUM

A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panic.

Risk Scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatcontainer-native-virtualization/vm-network-latency-checkup-rhel9@sha256:59fd965975bccf641a0fa7aa01374d45057bd03cda7528248a84b60b1205bf57_amd64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/vm-network-latency-checkup-rhel9@sha256:59fd965975bccf641a0fa7aa01374d45057bd03cda7528248a84b60b1205bf57_amd64
Red Hatcontainer-native-virtualization/kubevirt-tekton-tasks-cleanup-vm-rhel9@sha256:28e4975fa4dac22d9da32ed2a10aed039fd957b30140daa36bab2caa998be77a_amd64 as a component of CNV 4.13 for RHEL 9*, container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm-rhel9@sha256:28e4975fa4dac22d9da32ed2a10aed039fd957b30140daa36bab2caa998be77a_amd64, container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm-rhel9@sha256:28e4975fa4dac22d9da32ed2a10aed039fd957b30140daa36bab2caa998be77a_amd64
Red Hatcontainer-native-virtualization/virt-cdi-controller-rhel9@sha256:d9e62b2019328be258489ac852eef25f8b1233f29abac6bcea5b406329f97fed_amd64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/virt-cdi-controller-rhel9@sha256:d9e62b2019328be258489ac852eef25f8b1233f29abac6bcea5b406329f97fed_amd64
Red Hatcontainer-native-virtualization/virt-controller-rhel9@sha256:970edc281d7a731e9f7e8c2d4440fe48a221e5e355d5235c5413b4c3adb28503_arm64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/virt-controller-rhel9@sha256:970edc281d7a731e9f7e8c2d4440fe48a221e5e355d5235c5413b4c3adb28503_arm64
Red Hatcontainer-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:e681560b184189df03fc84c8a712f32289f42573dd348cda394b19565eb6eca8_arm64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:e681560b184189df03fc84c8a712f32289f42573dd348cda394b19565eb6eca8_arm64, container-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:e681560b184189df03fc84c8a712f32289f42573dd348cda394b19565eb6eca8_arm64, *
Red Hatcontainer-native-virtualization/cnv-must-gather-rhel9@sha256:9e8efd76924958eb605401abdac08eba97fb83a1ada383bc87a7fb7c87b3a455_arm64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/cnv-must-gather-rhel9@sha256:9e8efd76924958eb605401abdac08eba97fb83a1ada383bc87a7fb7c87b3a455_arm64, container-native-virtualization/cnv-must-gather-rhel9@sha256:9e8efd76924958eb605401abdac08eba97fb83a1ada383bc87a7fb7c87b3a455_arm64, *
Red Hatcontainer-native-virtualization/bridge-marker-rhel9@sha256:e8a55aee3d75a316bb0d7a554c737198823df04b3c05e481c17e45eb2153bced_arm64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/bridge-marker-rhel9@sha256:e8a55aee3d75a316bb0d7a554c737198823df04b3c05e481c17e45eb2153bced_arm64, *, container-native-virtualization/bridge-marker-rhel9@sha256:e8a55aee3d75a316bb0d7a554c737198823df04b3c05e481c17e45eb2153bced_arm64
Red Hatcontainer-native-virtualization/ovs-cni-plugin-rhel9@sha256:e8e7a44edbf1713fe74de5c4b8f691cce78f4440c4a32a16ba9ad16694a55396_amd64 as a component of CNV 4.13 for RHEL 9*
Red Hatcontainer-native-virtualization/virtio-win-rhel9@sha256:d147d2a6eb6f907d1e88f61aaca83596853bc72164583d6dda2b1154b490de25_amd64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/virtio-win-rhel9@sha256:d147d2a6eb6f907d1e88f61aaca83596853bc72164583d6dda2b1154b490de25_amd64, container-native-virtualization/virtio-win-rhel9@sha256:d147d2a6eb6f907d1e88f61aaca83596853bc72164583d6dda2b1154b490de25_amd64, *
Red Hatcontainer-native-virtualization/virt-cdi-cloner-rhel9@sha256:68e3b9b0291b4fb277ac430269ffce11d13b0a7688cf2ffcdb7f98759c36b4db_amd64 as a component of CNV 4.13 for RHEL 9*, *, container-native-virtualization/virt-cdi-cloner-rhel9@sha256:68e3b9b0291b4fb277ac430269ffce11d13b0a7688cf2ffcdb7f98759c36b4db_amd64
Red Hatcontainer-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:6775f34353eec8f35bead9411dde155530d079bb8d51582fb1f2aacc27dbde1d_amd64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:6775f34353eec8f35bead9411dde155530d079bb8d51582fb1f2aacc27dbde1d_amd64
Red Hatcontainer-native-virtualization/kubesecondarydns-rhel9@sha256:121d30d78cc57731ea2242ef2c32430890ac66c2723e65608d5e2f26c3f515cd_amd64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/kubesecondarydns-rhel9@sha256:121d30d78cc57731ea2242ef2c32430890ac66c2723e65608d5e2f26c3f515cd_amd64, *, *
Red Hatcontainer-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:571ae805641dea11646028c946039983c7fd82f138b915dcb8b80c39b465e63c_arm64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:571ae805641dea11646028c946039983c7fd82f138b915dcb8b80c39b465e63c_arm64, container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:571ae805641dea11646028c946039983c7fd82f138b915dcb8b80c39b465e63c_arm64, container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:571ae805641dea11646028c946039983c7fd82f138b915dcb8b80c39b465e63c_arm64
Red Hatcontainer-native-virtualization/virt-exportproxy-rhel9@sha256:de3c4afbf7669b98517cbef2490ec186f0553dd97b05bed80ec36dd883fe507b_arm64 as a component of CNV 4.13 for RHEL 9*, container-native-virtualization/virt-exportproxy-rhel9@sha256:de3c4afbf7669b98517cbef2490ec186f0553dd97b05bed80ec36dd883fe507b_arm64, *
Red Hatcontainer-native-virtualization/virt-cdi-cloner-rhel9@sha256:6ac212767481bef64d8a7d0252bb8089c0f9751fad4a355aef71bd49dad2ad07_arm64 as a component of CNV 4.13 for RHEL 9*
Red Hatcontainer-native-virtualization/kubevirt-tekton-tasks-modify-vm-template-rhel9@sha256:31d959b80cf57462e1705684bb7e1b78af26bd2c62f1c9e4e51e1d02199b05a8_arm64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template-rhel9@sha256:31d959b80cf57462e1705684bb7e1b78af26bd2c62f1c9e4e51e1d02199b05a8_arm64
Red Hatcontainer-native-virtualization/kubevirt-ssp-operator-rhel9@sha256:901e6cad9534c7bd7c4018c60bccfe49d7280fba5a9901ab4c4d15e9345288c4_amd64 as a component of CNV 4.13 for RHEL 9*
Red Hatcontainer-native-virtualization/kubevirt-tekton-tasks-modify-vm-template-rhel9@sha256:31d959b80cf57462e1705684bb7e1b78af26bd2c62f1c9e4e51e1d02199b05a8_arm64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template-rhel9@sha256:31d959b80cf57462e1705684bb7e1b78af26bd2c62f1c9e4e51e1d02199b05a8_arm64, container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template-rhel9@sha256:31d959b80cf57462e1705684bb7e1b78af26bd2c62f1c9e4e51e1d02199b05a8_arm64, *
Red Hatcontainer-native-virtualization/virt-launcher-rhel9@sha256:4990d40d9987d5126d105dd45be2501eaded248cb61bdde5ea8d359bc1e7ebef_amd64 as a component of CNV 4.13 for RHEL 9*, container-native-virtualization/virt-launcher-rhel9@sha256:4990d40d9987d5126d105dd45be2501eaded248cb61bdde5ea8d359bc1e7ebef_amd64, *
Red Hatcontainer-native-virtualization/virt-artifacts-server-rhel9@sha256:81fc61b714baecb5a89fa6c0749c14566e0661b8e184ca602fc2e03b9cf431ee_amd64 as a component of CNV 4.13 for RHEL 9container-native-virtualization/virt-artifacts-server-rhel9@sha256:81fc61b714baecb5a89fa6c0749c14566e0661b8e184ca602fc2e03b9cf431ee_amd64, *, *

…and 165 more

Timeline

  • May 18, 2023 CVE Published
  • Apr 25, 2026 Distribution Patch
  • Apr 25, 2026 Distribution Patch
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory

References

…and 232 more

Open in Interactive Console →
$ Console Community · 100/wk Open console ›