登录 注册
开源 企业版 高校版 私有云 模力方舟 Gitee AI
扫描微信二维码支付
取消
支付完成
Watch
不关注 关注所有动态 仅关注版本发行动态 关注但不提醒动态
12 Star 0 Fork 27

src-openEuler/etcd

代码 Issues 22 Pull Requests 2 Wiki 统计 流水线
服务
Issues
 / 详情

CVE-2022-24675

已完成
CVE和安全问题
openeuler-ci-bot
拥有者
创建于  
2024-09-19 11:28

一、漏洞信息
漏洞编号：CVE-2022-24675
漏洞归属组件：etcd
漏洞归属的版本：3.4.14,3.4.7
CVSS V3.0分值：
BaseScore：7.5 High
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
漏洞公开时间：2022-04-20 18:15:07
漏洞创建时间：2024-09-19 11:28:52
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2022-24675

更多参考(点击展开)
参考来源 参考链接 来源链接
cve.mitre.org https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
cve.mitre.org https://groups.google.com/g/golang-announce
cve.mitre.org https://groups.google.com/g/golang-announce/c/oecdBNLOml8
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/
cve.mitre.org https://security.gentoo.org/glsa/202208-02
cve.mitre.org https://security.netapp.com/advisory/ntap-20220915-0010/
redhat_bugzilla https://go.dev/issue/51853 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://go-review.googlesource.com/c/go/+/399816/ https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/errata/RHSA-2022:5006 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/errata/RHSA-2022:5337 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/errata/RHSA-2022:5415 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688
redhat_bugzilla https://access.redhat.com/security/cve/cve-2022-24675 https://bugzilla.redhat.com/show_bug.cgi?id=2077688

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)
影响的包 修复版本 修复补丁 问题引入补丁 来源
https://groups.google.com/g/golang-announce nvd
https://groups.google.com/g/golang-announce/c/oecdBNLOml8 nvd
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/ nvd
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/ nvd
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/ nvd
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/ nvd
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/ nvd
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/ nvd
https://security.gentoo.org/glsa/202208-02 nvd
https://security.netapp.com/advisory/ntap-20220915-0010/ nvd

二、漏洞分析结构反馈
影响性分析说明：
在Go语言的encoding/pem包中，存在一个堆栈溢出漏洞，影响了Go 1.17.9之前的版本和1.18.x系列中1.18.1之前的版本。该漏洞可以通过大量的PEM格式数据触发Decode函数时引起。当解码特别构造的大规模PEM数据时，由于递归调用或分配过多的局部变量，可能会超出函数调用栈的容量，从而导致堆栈溢出。这不仅可能导致应用程序崩溃，还可能被恶意利用来执行远程代码或进行其他攻击。
openEuler评分：
7.5
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP4(3.4.14):受影响
2.openEuler-22.03-LTS-SP1(3.4.14):受影响
3.openEuler-22.03-LTS-SP3(3.4.14):受影响
4.openEuler-22.03-LTS-SP4(3.4.14):受影响
5.master(3.4.14):不受影响
6.openEuler-24.03-LTS(3.4.14):不受影响
7.openEuler-24.03-LTS-Next(3.4.14):不受影响
8.openEuler-24.03-LTS-SP1(3.4.14):不受影响

修复是否涉及abi变化(是/否)：
1.master(3.4.14):否
2.openEuler-20.03-LTS-SP4(3.4.14):否
3.openEuler-22.03-LTS-SP1(3.4.14):否
4.openEuler-22.03-LTS-SP3(3.4.14):否
5.openEuler-22.03-LTS-SP4(3.4.14):否
6.openEuler-24.03-LTS(3.4.14):否
7.openEuler-24.03-LTS-Next(3.4.14):否
8.openEuler-24.03-LTS-SP1(3.4.14):否

原因说明：
1.master(3.4.14):
2.openEuler-20.03-LTS-SP4(3.4.14):
3.openEuler-22.03-LTS-SP3(3.4.14):
4.openEuler-22.03-LTS-SP4(3.4.14):
5.openEuler-24.03-LTS(3.4.14):
6.openEuler-24.03-LTS-Next(3.4.14):
7.openEuler-24.03-LTS-SP1(3.4.14):

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1123

评论 (7)

5329419 openeuler ci bot 1632792936
openeuler-ci-bot 创建了CVE和安全问题 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 添加了
 
CVE/UNFIXED
标签 7个月前
展开全部操作日志
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 添加了
 
sig/sig-CloudNative
标签 7个月前
参考网址 关联pr 状态 补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2022-24675NoneNonehttps://groups.google.com/g/golang-announce/c/oecd
https://ubuntu.com/security/CVE-2022-24675NoneNonehttps://groups.google.com/g/golang-announce/c/oecd
https://discourse.ubuntu.com/c/ubuntu-pro
https://www.opencve.io/cve/CVE-2022-24675NoneNonehttps://groups.google.com/g/golang-announce/c/oecd
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-24675NoneNonehttps://go-review.googlesource.com/c/go
https://security-tracker.debian.org/tracker/CVE-2022-24675NoneNonehttps://groups.google.com/g/golang-announce/c/oecd

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 将计划开始日期设置为2024-09-20 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 将计划截止日期设置为2024-10-04 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 将优先级设置为主要 7个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 将负责人设置为haozi007 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 6个月前

影响性分析说明：
在Go语言的encoding/pem包中，存在一个堆栈溢出漏洞，影响了Go 1.17.9之前的版本和1.18.x系列中1.18.1之前的版本。该漏洞可以通过大量的PEM格式数据触发Decode函数时引起。当解码特别构造的大规模PEM数据时，由于递归调用或分配过多的局部变量，可能会超出函数调用栈的容量，从而导致堆栈溢出。这不仅可能导致应用程序崩溃，还可能被恶意利用来执行远程代码或进行其他攻击。
openEuler评分：
7.5
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(3.4.14):不受影响
2.openEuler-20.03-LTS-SP4(3.4.14):受影响
3.openEuler-22.03-LTS-SP1(3.4.14):受影响
4.openEuler-22.03-LTS-SP3(3.4.14):受影响
5.openEuler-22.03-LTS-SP4(3.4.14):受影响
6.openEuler-24.03-LTS(3.4.14):不受影响
7.openEuler-24.03-LTS-Next(3.4.14):不受影响

修复是否涉及abi变化(是/否)：
1.master(3.4.14):否
2.openEuler-20.03-LTS-SP4(3.4.14):否
3.openEuler-22.03-LTS-SP1(3.4.14):否
4.openEuler-22.03-LTS-SP3(3.4.14):否
5.openEuler-22.03-LTS-SP4(3.4.14):否
6.openEuler-24.03-LTS(3.4.14):否
7.openEuler-24.03-LTS-Next(3.4.14):否
原因说明：
1.master(3.4.14):不受影响
2.openEuler-20.03-LTS-SP4(3.4.14):golang版本问题
3.openEuler-22.03-LTS-SP1(3.4.14):golang版本问题
4.openEuler-22.03-LTS-SP3(3.4.14):golang版本问题
5.openEuler-22.03-LTS-SP4(3.4.14):golang版本问题
6.openEuler-24.03-LTS(3.4.14):不受影响
7.openEuler-24.03-LTS-Next(3.4.14):不受影响
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 3个月前

影响性分析说明：
在Go语言的encoding/pem包中，存在一个堆栈溢出漏洞，影响了Go 1.17.9之前的版本和1.18.x系列中1.18.1之前的版本。该漏洞可以通过大量的PEM格式数据触发Decode函数时引起。当解码特别构造的大规模PEM数据时，由于递归调用或分配过多的局部变量，可能会超出函数调用栈的容量，从而导致堆栈溢出。这不仅可能导致应用程序崩溃，还可能被恶意利用来执行远程代码或进行其他攻击。
openEuler评分：
7.5
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(3.4.14):不受影响
2.openEuler-20.03-LTS-SP4(3.4.14):受影响
3.openEuler-22.03-LTS-SP1(3.4.14):受影响
4.openEuler-22.03-LTS-SP3(3.4.14):受影响
5.openEuler-22.03-LTS-SP4(3.4.14):受影响
6.openEuler-24.03-LTS(3.4.14):不受影响
7.openEuler-24.03-LTS-Next(3.4.14):不受影响
8.openEuler-24.03-LTS-SP1(3.4.14):不受影响
修复是否涉及abi变化(是/否)：
1.master(3.4.14):否
2.openEuler-20.03-LTS-SP4(3.4.14):否
3.openEuler-22.03-LTS-SP1(3.4.14):否
4.openEuler-22.03-LTS-SP3(3.4.14):否
5.openEuler-22.03-LTS-SP4(3.4.14):否
6.openEuler-24.03-LTS(3.4.14):否
7.openEuler-24.03-LTS-Next(3.4.14):否
8.openEuler-24.03-LTS-SP1(3.4.14):否
原因说明：
1.master(3.4.14):不受影响
2.openEuler-20.03-LTS-SP4(3.4.14):golang版本问题
3.openEuler-22.03-LTS-SP1(3.4.14):golang版本问题
4.openEuler-22.03-LTS-SP3(3.4.14):golang版本问题
5.openEuler-22.03-LTS-SP4(3.4.14):golang版本问题
6.openEuler-24.03-LTS(3.4.14):不受影响
7.openEuler-24.03-LTS-Next(3.4.14):不受影响
8.openEuler-24.03-LTS-SP1(3.4.14):不受影响
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 3个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 通过合并 Pull Request !91: batch fix cve through rebuild and sync release 将任务状态从 待办的 修改为已完成 2个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 移除了
 
CVE/UNFIXED
标签 2个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 移除了
 
sig/sig-CloudNative
标签 2个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 添加了
 
CVE/FIXED
标签 2个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 添加了
 
sig/sig-CloudNative
标签 2个月前
5329419 openeuler ci bot 1632792936
openeuler-ci-bot 修改了描述 2个月前

登录 后才可以发表评论

状态
负责人
项目
未立项任务
未立项任务
Pull Requests
未关联
batch fix cve through rebuild and sync release [sync] PR-91: batch fix cve through rebuild and sync release [sync] PR-91: batch fix cve through rebuild and sync release
未关联
关联的 Pull Requests 被合并后可能会关闭此 issue
预计工期 （小时）
开始日期   -   截止日期
-
置顶选项
不置顶
不置顶
置顶等级：高
置顶等级：中
置顶等级：低
优先级
主要
不指定
严重
主要
次要
不重要
标签
CVE/FIXED
sig/sig-CloudNative
里程碑
未关联里程碑
未关联里程碑
分支
未关联
分支 (26)
标签 (32)
master
openEuler-24.03-LTS-Next
openEuler-24.03-LTS-SP2
openEuler-20.03-LTS-SP4
sync-pr118-openEuler-24.03-LTS-SP1-to-openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP1
openEuler-22.03-LTS-SP2
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-25.03
sync-pr91-openEuler-22.03-LTS-SP1-to-openEuler-20.03-LTS-SP4
openEuler-24.09
revert-merge-57-openEuler-24.03-LTS
openEuler-20.03-LTS-SP3
openEuler-22.03-LTS-Next
openEuler-22.03-LTS
openEuler-23.03
openEuler-23.09
openEuler-20.03-LTS-Next
openEuler-21.03
openEuler-21.09
openEuler-20.03-LTS-SP2
openEuler-20.09
openEuler-22.09
openEuler-25.03-release
openEuler-24.03-LTS-SP1-update-20250228
openEuler-22.03-LTS-SP3-update-20250228
openEuler-22.03-LTS-SP4-update-20250228
openEuler-20.03-LTS-SP4-update-20250228
openEuler-24.03-LTS-SP1-update-20250221
openEuler-22.03-LTS-SP4-update-20250221
openEuler-22.03-LTS-SP3-update-20250221
openEuler-20.03-LTS-SP4-update-20250221
openEuler-24.03-LTS-update-20250214
openEuler-22.03-LTS-SP4-update-20250214
openEuler-22.03-LTS-SP3-update-20250214
openEuler-24.03-LTS-SP1-release
openEuler-22.03-LTS-SP4-update-20241213
openEuler-22.03-LTS-SP3-update-20241213
openEuler-22.03-LTS-SP4-release
openEuler-24.09-release
openEuler-24.03-LTS-release
openEuler-22.03-LTS-SP3-release
openEuler-23.09-rc5
openEuler-22.03-LTS-SP1-release
openEuler-22.09-release
openEuler-22.09-rc5
openEuler-22.09-20220829
openEuler-22.03-LTS-20220331
openEuler-22.03-LTS-round5
openEuler-22.03-LTS-round3
openEuler-22.03-LTS-round2
openEuler-22.03-LTS-round1
openEuler-20.03-LTS-SP3-release
openEuler-20.03-LTS-SP2-20210624
openEuler-21.03-20210330
参与者（2）
5329419 openeuler ci bot 1632792936 Running Tortoise-running-tortoise
1
https://gitee.com/src-openeuler/etcd.git
git@gitee.com:src-openeuler/etcd.git
src-openeuler
etcd
etcd
点此查找更多帮助

搜索帮助

Git 命令在线学习 如何在 Gitee 导入 GitHub 仓库
Git 仓库基础操作
企业版和社区版功能对比
SSH 公钥设置
如何处理代码冲突
仓库体积过大，如何减小？
如何找回被删除的仓库数据
Gitee 产品配额说明
GitHub仓库快速导入Gitee及同步更新
什么是 Release（发行版）
将 PHP 项目自动发布到 packagist.org
仓库举报
回到顶部