suse · CVE-2022-24675

Quick triage

View at Official suse advisory, NVD, CVE.org · CVE detail

Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.

Tracker summary

CVE-2022-24675 severity moderate: SUSE including 41 source package names (1.17-12.3:go1.17-1.17.9-150000.1.28.1, 1.18-7.3:go1.18-1.18.1-150000.1.11.1, …), 153 product×package rows across 36 product lines (Container bci/golang, SUSE CaaS Platform 4.0, … (36 product lines)): Fixed 107, Known Not Affected 46.

Description:

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.