opensuse-su-2022:0724-1
Vulnerability from csaf_opensuse
Published
2022-03-04 09:34
Modified
2022-03-04 09:34
Summary
Security update for go1.16

Notes

Title of the patch
Security update for go1.16
Description of the patch
This update for go1.16 fixes the following issues: - CVE-2022-23806: Fixed incorrect returned value in crypto/elliptic IsOnCurve (bsc#1195838). - CVE-2022-23772: Fixed overflow in Rat.SetString in math/big can lead to uncontrolled memory consumption (bsc#1195835). - CVE-2022-23773: Fixed incorrect access control in cmd/go (bsc#1195834). The following non-security bugs were fixed: - go#50977 crypto/elliptic: IsOnCurve returns true for invalid field elements - go#50700 math/big: Rat.SetString may consume large amount of RAM and crash - go#50686 cmd/go: do not treat branches with semantic-version names as releases - go#50866 cmd/compile: incorrect use of CMN on arm64 - go#50832 runtime/race: NoRaceMutexPureHappensBefore failures - go#50811 cmd/go: remove bitbucket VCS probing - go#50780 runtime: incorrect frame information in traceback traversal may hang the process. - go#50721 debug/pe: reading debug_info section of PE files that use the DWARF5 form DW_FORM_line_strp causes error - go#50682 cmd/compile: MOVWreg missing sign-extension following a Copy from a floating-point LoadReg - go#50645 testing: surprising interaction of subtests with TempDir - go#50585 net/http/httptest: add fipsonly compliant certificate in for NewTLSServer(), for dev.boringcrypto branch - go#50245 runtime: intermittent os/exec.Command.Start() Hang on Darwin in Presence of 'plugin' Package
Patchnames
openSUSE-SLE-15.3-2022-724,openSUSE-SLE-15.4-2022-724
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for go1.16",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for go1.16 fixes the following issues:\n\n- CVE-2022-23806: Fixed incorrect returned value in crypto/elliptic IsOnCurve (bsc#1195838).\n- CVE-2022-23772: Fixed overflow in Rat.SetString in math/big can lead to uncontrolled memory consumption (bsc#1195835).\n- CVE-2022-23773: Fixed incorrect access control in cmd/go (bsc#1195834).\n\nThe following non-security bugs were fixed:\n\n- go#50977 crypto/elliptic: IsOnCurve returns true for invalid field elements\n- go#50700 math/big: Rat.SetString may consume large amount of RAM and crash\n- go#50686 cmd/go: do not treat branches with semantic-version names as releases\n- go#50866 cmd/compile: incorrect use of CMN on arm64\n- go#50832 runtime/race: NoRaceMutexPureHappensBefore failures\n- go#50811 cmd/go: remove bitbucket VCS probing\n- go#50780 runtime: incorrect frame information in traceback traversal may hang the process.\n- go#50721 debug/pe: reading debug_info section of PE files that use the DWARF5 form DW_FORM_line_strp causes error\n- go#50682 cmd/compile: MOVWreg missing sign-extension following a Copy from a floating-point LoadReg\n- go#50645 testing: surprising interaction of subtests with TempDir\n- go#50585 net/http/httptest: add fipsonly compliant certificate in for NewTLSServer(), for dev.boringcrypto branch\n- go#50245 runtime: intermittent os/exec.Command.Start() Hang on Darwin in Presence of \u0027plugin\u0027 Package\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-SLE-15.3-2022-724,openSUSE-SLE-15.4-2022-724",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2022_0724-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2022:0724-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMRYQV73OUYCKMEO4GSE5KGQ7EEQYJHV/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2022:0724-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMRYQV73OUYCKMEO4GSE5KGQ7EEQYJHV/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182345",
        "url": "https://bugzilla.suse.com/1182345"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1195834",
        "url": "https://bugzilla.suse.com/1195834"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1195835",
        "url": "https://bugzilla.suse.com/1195835"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1195838",
        "url": "https://bugzilla.suse.com/1195838"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-23772 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-23772/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-23773 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-23773/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-23806 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-23806/"
      }
    ],
    "title": "Security update for go1.16",
    "tracking": {
      "current_release_date": "2022-03-04T09:34:13Z",
      "generator": {
        "date": "2022-03-04T09:34:13Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2022:0724-1",
      "initial_release_date": "2022-03-04T09:34:13Z",
      "revision_history": [
        {
          "date": "2022-03-04T09:34:13Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.16-1.16.14-1.43.1.aarch64",
                "product": {
                  "name": "go1.16-1.16.14-1.43.1.aarch64",
                  "product_id": "go1.16-1.16.14-1.43.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.16-doc-1.16.14-1.43.1.aarch64",
                "product": {
                  "name": "go1.16-doc-1.16.14-1.43.1.aarch64",
                  "product_id": "go1.16-doc-1.16.14-1.43.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.16-race-1.16.14-1.43.1.aarch64",
                "product": {
                  "name": "go1.16-race-1.16.14-1.43.1.aarch64",
                  "product_id": "go1.16-race-1.16.14-1.43.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.16-1.16.14-1.43.1.ppc64le",
                "product": {
                  "name": "go1.16-1.16.14-1.43.1.ppc64le",
                  "product_id": "go1.16-1.16.14-1.43.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.16-doc-1.16.14-1.43.1.ppc64le",
                "product": {
                  "name": "go1.16-doc-1.16.14-1.43.1.ppc64le",
                  "product_id": "go1.16-doc-1.16.14-1.43.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.16-1.16.14-1.43.1.s390x",
                "product": {
                  "name": "go1.16-1.16.14-1.43.1.s390x",
                  "product_id": "go1.16-1.16.14-1.43.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.16-doc-1.16.14-1.43.1.s390x",
                "product": {
                  "name": "go1.16-doc-1.16.14-1.43.1.s390x",
                  "product_id": "go1.16-doc-1.16.14-1.43.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.16-1.16.14-1.43.1.x86_64",
                "product": {
                  "name": "go1.16-1.16.14-1.43.1.x86_64",
                  "product_id": "go1.16-1.16.14-1.43.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.16-doc-1.16.14-1.43.1.x86_64",
                "product": {
                  "name": "go1.16-doc-1.16.14-1.43.1.x86_64",
                  "product_id": "go1.16-doc-1.16.14-1.43.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.16-race-1.16.14-1.43.1.x86_64",
                "product": {
                  "name": "go1.16-race-1.16.14-1.43.1.x86_64",
                  "product_id": "go1.16-race-1.16.14-1.43.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.3",
                "product": {
                  "name": "openSUSE Leap 15.3",
                  "product_id": "openSUSE Leap 15.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-1.16.14-1.43.1.aarch64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64"
        },
        "product_reference": "go1.16-1.16.14-1.43.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-1.16.14-1.43.1.ppc64le as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le"
        },
        "product_reference": "go1.16-1.16.14-1.43.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-1.16.14-1.43.1.s390x as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x"
        },
        "product_reference": "go1.16-1.16.14-1.43.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-1.16.14-1.43.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64"
        },
        "product_reference": "go1.16-1.16.14-1.43.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-doc-1.16.14-1.43.1.aarch64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64"
        },
        "product_reference": "go1.16-doc-1.16.14-1.43.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-doc-1.16.14-1.43.1.ppc64le as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le"
        },
        "product_reference": "go1.16-doc-1.16.14-1.43.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-doc-1.16.14-1.43.1.s390x as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x"
        },
        "product_reference": "go1.16-doc-1.16.14-1.43.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-doc-1.16.14-1.43.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64"
        },
        "product_reference": "go1.16-doc-1.16.14-1.43.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-race-1.16.14-1.43.1.aarch64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64"
        },
        "product_reference": "go1.16-race-1.16.14-1.43.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.16-race-1.16.14-1.43.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
        },
        "product_reference": "go1.16-race-1.16.14-1.43.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-23772",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-23772"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
          "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-23772",
          "url": "https://www.suse.com/security/cve/CVE-2022-23772"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1195835 for CVE-2022-23772",
          "url": "https://bugzilla.suse.com/1195835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-03-04T09:34:13Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-23772"
    },
    {
      "cve": "CVE-2022-23773",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-23773"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
          "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-23773",
          "url": "https://www.suse.com/security/cve/CVE-2022-23773"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1195834 for CVE-2022-23773",
          "url": "https://bugzilla.suse.com/1195834"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-03-04T09:34:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-23773"
    },
    {
      "cve": "CVE-2022-23806",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-23806"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
          "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
          "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
          "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
          "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-23806",
          "url": "https://www.suse.com/security/cve/CVE-2022-23806"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1195838 for CVE-2022-23806",
          "url": "https://bugzilla.suse.com/1195838"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1206559 for CVE-2022-23806",
          "url": "https://bugzilla.suse.com/1206559"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208723 for CVE-2022-23806",
          "url": "https://bugzilla.suse.com/1208723"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.ppc64le",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.s390x",
            "openSUSE Leap 15.3:go1.16-doc-1.16.14-1.43.1.x86_64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.aarch64",
            "openSUSE Leap 15.3:go1.16-race-1.16.14-1.43.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-03-04T09:34:13Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-23806"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.