Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Go | Golang | * | 1.17.12 (excluding) |
| Go | Golang | 1.18.0 (including) | 1.18.4 (excluding) |
| OADP-1.1-RHEL-8 | RedHat | oadp/oadp-velero-rhel8:1.1.1-20 | * |
| OpenShift Custom Metrics Autoscaler 2 | RedHat | custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8:2.8.2-143 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/client-kn-rhel8:1.3.1-4 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-controller-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.3.2-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.3.2-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.3.2-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-mtping-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-storage-version-migration-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-sugar-controller-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/eventing-webhook-rhel8:1.3.2-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/ingress-rhel8-operator:1.24.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/knative-rhel8-operator:1.24.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/kn-cli-artifacts-rhel8:1.3.1-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/kourier-control-rhel8:1.3.0-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/net-istio-controller-rhel8:1.3.0-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/net-istio-webhook-rhel8:1.3.0-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serverless-operator-bundle:1.24.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serverless-rhel8-operator:1.24.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-activator-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-autoscaler-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-controller-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-domain-mapping-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-queue-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-storage-version-migration-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/serving-webhook-rhel8:1.3.0-3 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1/svls-must-gather-rhel8:1.24.0-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8:1.3.2-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8:1.3.2-2 | * |
| Openshift Serveless 1.24 | RedHat | openshift-serverless-1-tech-preview/eventing-kafka-broker-webhook-rhel8:1.3.2-2 | * |
| Openshift Serverless 1 on RHEL 8 | RedHat | openshift-serverless-clients-0:1.3.1-4.el8 | * |
| OSSO-1.1-RHEL-8 | RedHat | openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8:v1.1-11 | * |
| Red Hat Ceph Storage 6.1 | RedHat | rhceph/rhceph-6-dashboard-rhel9:6-75 | * |
| Red Hat Developer Tools | RedHat | go-toolset-1.17-golang-0:1.17.12-1.el7_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | go-toolset:rhel8-8060020220720230014.97d7f71f | * |
| Red Hat Enterprise Linux 8 | RedHat | git-lfs-0:2.13.3-3.el8_6 | * |
| Red Hat Enterprise Linux 8 | RedHat | grafana-0:7.5.15-3.el8 | * |
| Red Hat Enterprise Linux 8 | RedHat | grafana-pcp-0:3.2.0-2.el8 | * |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:rhel8-8080020230321153727.0f77c1b7 | * |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:4.0-8080020230217080101.8108cfbc | * |
| Red Hat Enterprise Linux 9 | RedHat | golang-0:1.17.12-1.el9_0 | * |
| Red Hat Enterprise Linux 9 | RedHat | grafana-0:7.5.15-3.el9 | * |
| Red Hat Enterprise Linux 9 | RedHat | grafana-pcp-0:3.2.0-3.el9 | * |
| Red Hat Enterprise Linux 9 | RedHat | git-lfs-0:3.2.0-1.el9 | * |
| Red Hat Migration Toolkit for Containers 1.7 | RedHat | rhmtc/openshift-velero-plugin-rhel8:v1.7.6-5 | * |
| Red Hat OpenShift Service Mesh 2.2 for RHEL 8 | RedHat | openshift-service-mesh/istio-cni-rhel8:2.2.2-7 | * |
| Red Hat OpenShift Service Mesh 2.2 for RHEL 8 | RedHat | openshift-service-mesh/istio-rhel8-operator:2.2.2-8 | * |
| Red Hat OpenShift Service Mesh 2.2 for RHEL 8 | RedHat | openshift-service-mesh/pilot-rhel8:2.2.2-7 | * |
| Red Hat OpenShift Service Mesh 2.2 for RHEL 8 | RedHat | openshift-service-mesh/prometheus-rhel8:2.2.2-4 | * |
| Red Hat OpenShift Service Mesh 2.2 for RHEL 8 | RedHat | openshift-service-mesh/proxyv2-rhel8:2.2.2-8 | * |
| Red Hat OpenShift Service Mesh 2.2 for RHEL 8 | RedHat | openshift-service-mesh/ratelimit-rhel8:2.2.2-4 | * |
| Red Hat OpenStack Platform 16.1 | RedHat | etcd-0:3.3.23-12.el8ost | * |
| Red Hat OpenStack Platform 16.2 | RedHat | etcd-0:3.3.23-12.el8ost | * |
| RHEL-7-CNV-4.12 | RedHat | kubevirt-0:4.12.0-1057.el7 | * |
| RHEL-8-CNV-4.12 | RedHat | kubevirt-0:4.12.0-1057.el8 | * |
| RHEL-8-CNV-4.12 | RedHat | container-native-virtualization/virt-api:v4.12.0-255 | * |
| RHODF-4.13-RHEL-9 | RedHat | odf4/mcg-rhel9-operator:v4.13.0-41 | * |
| Golang-1.13 | Ubuntu | bionic | * |
| Golang-1.13 | Ubuntu | esm-apps/bionic | * |
| Golang-1.13 | Ubuntu | esm-apps/jammy | * |
| Golang-1.13 | Ubuntu | esm-apps/xenial | * |
| Golang-1.13 | Ubuntu | esm-infra/focal | * |
| Golang-1.13 | Ubuntu | focal | * |
| Golang-1.13 | Ubuntu | jammy | * |
| Golang-1.13 | Ubuntu | trusty | * |
| Golang-1.13 | Ubuntu | xenial | * |
| Golang-1.16 | Ubuntu | bionic | * |
| Golang-1.16 | Ubuntu | esm-apps/bionic | * |
| Golang-1.16 | Ubuntu | esm-apps/focal | * |
| Golang-1.16 | Ubuntu | focal | * |
| Golang-1.16 | Ubuntu | trusty | * |
| Golang-1.16 | Ubuntu | xenial | * |
| Golang-1.18 | Ubuntu | bionic | * |
| Golang-1.18 | Ubuntu | focal | * |
| Golang-1.18 | Ubuntu | jammy | * |