Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

encoding/pem: stack overflow (CVE-2022-24675) [1.17 backport] #52036

Closed
gopherbot opened this issue Mar 30, 2022 · 7 comments
Closed

encoding/pem: stack overflow (CVE-2022-24675) [1.17 backport] #52036

gopherbot opened this issue Mar 30, 2022 · 7 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Milestone
Go1.17.9

Comments

@gopherbot
Copy link

@FiloSottile requested issue #51853 to be considered for backport to the next 1.17 minor release.

@gopherbot please open backport issues for this security fix.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Mar 30, 2022
@gopherbot gopherbot mentioned this issue Mar 30, 2022
Closed
@gopherbot gopherbot added this to the Go1.17.9 milestone Mar 30, 2022
@cherrymui cherrymui added the CherryPickApproved Used during the release process for point releases label Apr 6, 2022
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Apr 6, 2022
@gopherbot
Copy link
Author

Change https://go.dev/cl/399816 mentions this issue: [release-branch.go1.17] encoding/pem: fix stack overflow in Decode

@gopherbot
Copy link
Author

Closed by merging 2116d60 to release-branch.go1.17.

gopherbot pushed a commit that referenced this issue Apr 12, 2022
@julieqiu @dmitshur
[release-branch.go1.17] encoding/pem: fix stack overflow in Decode
2116d60 
Previously, Decode called decodeError, a recursive function that was
prone to stack overflows when given a large PEM file containing errors.

Credit to Juho Nurminen of Mattermost who reported the error.

Fixes CVE-2022-24675
Updates #51853
Fixes #52036

Change-Id: Iffe768be53c8ddc0036fea0671d290f8f797692c
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1391157
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Filippo Valsorda <valsorda@google.com>
(cherry picked from commit 794ea5e828010e8b68493b2fc6d2963263195a02)
Reviewed-on: https://go-review.googlesource.com/c/go/+/399816
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
@dmitshur dmitshur changed the title security: fix CVE-2022-24675 [1.17 backport] encoding/pem: stack overflow [1.17 backport] Apr 12, 2022
@thaJeztah
Copy link
Contributor

@FiloSottile @dmitshur I noticed that CVE-2022-24675 was removed from the titles of this ticket and #52037, and was curious why; are the patches only a partial fix, or is there another reason for removing it?

@dmitshur
Copy link
Contributor

@thaJeztah The intention of the title change was, now that the fix is released, to make more than just the CVE ID part of its description public. The CVE ID of this security fix is still included in the body of the parent issue #51853 which has the complete description of the security fix.

@thaJeztah
Copy link
Contributor

Thanks for clarifying!

FWIW, having CVE as part of the title can make it easier to discover (without having to look at the commit description, which is two additional clicks); the release history (https://go.dev/doc/devel/release#go1.17.minor) links to https://github.com/golang/go/issues?q=milestone%3AGo1.17.9+label%3ACherryPickApproved for details, and it can be useful to make these changes stand out (especially if there's various other changes included in a release).

@dmitshur
Copy link
Contributor

That makes sense. It'd also be consistent with the titles of the public-track security fixes including the CVE ID. I'll make the change, thanks for the suggestion.

@dmitshur dmitshur changed the title encoding/pem: stack overflow [1.17 backport] encoding/pem: stack overflow (CVE-2022-24675) [1.17 backport] Apr 19, 2022
@thaJeztah
Copy link
Contributor

Thanks again!

@knz knz mentioned this issue May 25, 2022
Closed
danbudris pushed a commit to danbudris/go that referenced this issue Sep 9, 2022
@julieqiu @danbudris
[release-branch.go1.17] encoding/pem: fix stack overflow in Decode
228f3af 
Previously, Decode called decodeError, a recursive function that was
prone to stack overflows when given a large PEM file containing errors.

Credit to Juho Nurminen of Mattermost who reported the error.

Fixes CVE-2022-24675
Updates golang#51853
Fixes golang#52036

Change-Id: Iffe768be53c8ddc0036fea0671d290f8f797692c
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1391157
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Filippo Valsorda <valsorda@google.com>
(cherry picked from commit 794ea5e828010e8b68493b2fc6d2963263195a02)
Reviewed-on: https://go-review.googlesource.com/c/go/+/399816
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
danbudris pushed a commit to danbudris/go that referenced this issue Sep 14, 2022
@julieqiu @danbudris
[release-branch.go1.17] encoding/pem: fix stack overflow in Decode
b3af1d2 
Previously, Decode called decodeError, a recursive function that was
prone to stack overflows when given a large PEM file containing errors.

Credit to Juho Nurminen of Mattermost who reported the error.

Fixes CVE-2022-24675
Updates golang#51853
Fixes golang#52036

Change-Id: Iffe768be53c8ddc0036fea0671d290f8f797692c
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1391157
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Filippo Valsorda <valsorda@google.com>
(cherry picked from commit 794ea5e828010e8b68493b2fc6d2963263195a02)
Reviewed-on: https://go-review.googlesource.com/c/go/+/399816
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
rcrozean pushed a commit to rcrozean/go that referenced this issue Oct 5, 2022
@julieqiu @rcrozean
encoding/pem: fix stack overflow in Decode
ab3d8a5 
# AWS EKS
Backported To: go-1.15.15-eks
Backported On: Thu, 22 Sept 2022
Backported By: budris@amazon.com
Backported From: release-branch.go1.17
EKS Patch Source Commit: danbudris@b3af1d2
Upstream Source Commit: golang@2116d60

# Original Information

Previously, Decode called decodeError, a recursive function that was
prone to stack overflows when given a large PEM file containing errors.

Credit to Juho Nurminen of Mattermost who reported the error.

Fixes CVE-2022-24675
Updates golang#51853
Fixes golang#52036

Change-Id: Iffe768be53c8ddc0036fea0671d290f8f797692c
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1391157
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Filippo Valsorda <valsorda@google.com>
(cherry picked from commit 794ea5e828010e8b68493b2fc6d2963263195a02)
Reviewed-on: https://go-review.googlesource.com/c/go/+/399816
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
rcrozean pushed a commit to rcrozean/go that referenced this issue Oct 12, 2022
@julieqiu @rcrozean
encoding/pem: fix stack overflow in Decode
084f7c2 
# AWS EKS
Backported To: go-1.15.15-eks
Backported On: Thu, 22 Sept 2022
Backported By: budris@amazon.com
Backported From: release-branch.go1.17
EKS Patch Source Commit: danbudris@b3af1d2
Upstream Source Commit: golang@2116d60

# Original Information

Previously, Decode called decodeError, a recursive function that was
prone to stack overflows when given a large PEM file containing errors.

Credit to Juho Nurminen of Mattermost who reported the error.

Fixes CVE-2022-24675
Updates golang#51853
Fixes golang#52036

Change-Id: Iffe768be53c8ddc0036fea0671d290f8f797692c
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1391157
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Filippo Valsorda <valsorda@google.com>
(cherry picked from commit 794ea5e828010e8b68493b2fc6d2963263195a02)
Reviewed-on: https://go-review.googlesource.com/c/go/+/399816
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
rcrozean pushed a commit to rcrozean/go that referenced this issue Oct 12, 2022
@julieqiu @rcrozean
encoding/pem: fix stack overflow in Decode
bb6c634 
# AWS EKS
Backported To: go-1.16.15-eks
Backported On: Tue, 04 Oct 2022
Backported By: budris@amazon.com
Backported From: release-branch.go1.17
EKS Patch Source Commit: danbudris@228f3af
Upstream Source Commit: golang@2116d60

# Original Information

Previously, Decode called decodeError, a recursive function that was
prone to stack overflows when given a large PEM file containing errors.

Credit to Juho Nurminen of Mattermost who reported the error.

Fixes CVE-2022-24675
Updates golang#51853
Fixes golang#52036

Change-Id: Iffe768be53c8ddc0036fea0671d290f8f797692c
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1391157
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Filippo Valsorda <valsorda@google.com>
(cherry picked from commit 794ea5e828010e8b68493b2fc6d2963263195a02)
Reviewed-on: https://go-review.googlesource.com/c/go/+/399816
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
@golang golang locked and limited conversation to collaborators Apr 19, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Projects
None yet
Milestone
Go1.17.9
Development

No branches or pull requests
5 participants
@FiloSottile @thaJeztah @dmitshur @gopherbot @cherrymui