Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.
Weakness
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | RedHat | rhacm2/submariner-rhel9-operator:1782933193 | * |
| Red Hat Hardened Images | RedHat | grype-main-0.115.0-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | syft-main-1.46.0-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | trivy-main-0.72.0-0.1.hum1 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/cephcsi-rhel9:1782932114 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/cephcsi-rhel9-operator:1782931768 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/devicefinder-rhel9:1782932104 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/mcg-core-rhel9:1783536000 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/mcg-rhel9-operator:1783535989 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/ocs-client-console-rhel9:1783536515 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/ocs-client-rhel9-operator:1782932521 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/ocs-metrics-exporter-rhel9:1783018461 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/ocs-rhel9-operator:1783018421 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-blackbox-exporter-rhel9:1782932812 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-cli-rhel9:1783537001 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-cloudnative-pg-rhel9-operator:1782932919 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-console-rhel9:1783537586 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-cosi-sidecar-rhel9:1782932969 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-csi-addons-rhel9-operator:1782933015 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-csi-addons-sidecar-rhel9:1782933042 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-drbd-rhel9:1783537392 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-external-snapshotter-rhel9-operator:1782933235 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-external-snapshotter-sidecar-rhel9:1782933251 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-multicluster-console-rhel9:1783537955 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-multicluster-rhel9-operator:1782933417 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-must-gather-rhel9:1783537742 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odf-rhel9-operator:1782933602 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odr-rhel9-operator:1783019377 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odr-volsync-plugin-mover-rhel9:1782934054 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/odr-volsync-plugin-rhel9-operator:1782934036 | * |
| Red Hat Openshift Data Foundation 4.22 | RedHat | odf4/rook-ceph-rhel9-operator:1782934284 | * |
| Red Hat Trusted Artifact Signer 1.3 | RedHat | rhtas/gitsign-rhel9:1783959819 | * |
| Golang-github-go-git-go-billy | Ubuntu | questing | * |