Skip to:
We install the toolkit from the Percona website.Software link: https://downloads.percona.com/downloads/percona-toolkit/3.5.1/binary/tarball/percona-toolkit-3.5.1_x86_64.tar.gz
After installing the software and scanning the image with Twistlock gives us the below list of CVEs.
Can we expect a newer tar gz for Linux OS be published and when?
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
* CVE *
SEVERITY
CVSS
PACKAGE
VERSION
STATUS
PUBLISHED
DISCOVERED
* DESCRIPTION *
CVE-2022-41715
high
7.50
go
1.18.3
fixed in 1.19.2, 1.18.7
> 4 months
< 1 hour
Programs which compile regular expressions from
> 4 months ago
untrusted sources may be vulnerable to memory
exhaustion or denial of service. The parsed regexp
repre...
CVE-2022-32190
fixed in 1.18.6
> 5 months
JoinPath and URL.JoinPath do not remove ../ path
> 5 months ago
elements appended to a relative path. For example,
JoinPath(\"https://go.dev\", \"../go\") returns
th...
CVE-2022-32189
fixed in 1.18.5, 1.17.13
> 6 months
A too-short encoded message can cause a panic in
> 6 months ago
Float.GobDecode and Rat GobDecode in math/big in
Go before 1.17.13 and 1.18.5, potentially allowing
a...
CVE-2022-30635
fixed in 1.18.4, 1.17.12
Uncontrolled recursion in Decoder.Decode in
encoding/gob before Go 1.17.12 and Go 1.18.4
allows an attacker to cause a panic due to stack
exhaustion v...
CVE-2022-30633
Uncontrolled recursion in Unmarshal in
encoding/xml before Go 1.17.12 and Go 1.18.4
exhaustion via un...
CVE-2022-30632
Uncontrolled recursion in Glob in path/filepath
before Go 1.17.12 and Go 1.18.4 allows an attacker
to cause a panic due to stack exhaustion via a
path...
CVE-2022-30631
Uncontrolled recursion in Reader.Read in
compress/gzip before Go 1.17.12 and Go 1.18.4
exhaustion via...
CVE-2022-30630
Uncontrolled recursion in Glob in io/fs before Go
1.17.12 and Go 1.18.4 allows an attacker to cause
a panic due to stack exhaustion via a path which
c...
CVE-2022-2880
Requests forwarded by ReverseProxy include the
raw query parameters from the inbound request,
including unparseable parameters rejected by
net/http. T...
CVE-2022-2879
Reader.Read does not set a limit on the maximum
size of file headers. A maliciously crafted
archive could cause Read to allocate unbounded
amounts of ...
CVE-2022-28131
Uncontrolled recursion in Decoder.Skip in
CVE-2022-27664
fixed in 1.19.1, 1.18.6
In net/http in Go before 1.18.6 and 1.19.x before
1.19.1, attackers can cause a denial of service
because an HTTP/2 connection can hang during
closing...
CVE-2022-32148
medium
6.50
Improper exposure of client IP addresses
in net/http before Go 1.17.12 and Go
1.18.4 can be triggered by calling
httputil.ReverseProxy.ServeHTTP with ...
CVE-2022-1705
Acceptance of some invalid Transfer-Encoding
headers in the HTTP/1 client in net/http before
Go 1.17.12 and Go 1.18.4 allows HTTP request
smuggling if...
CVE-2022-1962
5.50
Uncontrolled recursion in the Parse functions in
go/parser before Go 1.17.12 and Go 1.18.4 allow an
attacker to cause a panic due to stack exhaustion
...
CVE-2022-41716
5.40
fixed in 1.19.3, 1.18.8
> 3 months
Due to unsanitized NUL values, attackers may be
> 3 months ago
able to maliciously set environment variables on
Windows. In syscall.StartProcess and os/exec.Cmd,
inv...
CVE-2022-41717
5.30
fixed in 1.19.4, 1.18.9
74 days
An attacker can cause excessive memory growth in a
70 days ago
Go server accepting HTTP/2 requests. HTTP/2 server
connections contain a cache of HTTP header keys
CVE-2022-41723
low
1.00
golang.org/x/net
v0.4.0
fixed in 0.7.0
4 days
A maliciously crafted HTTP/2 stream could cause
4 days ago
excessive CPU consumption in the HPACK decoder,
sufficient to cause a denial of service from a
small n...
Link to the pull request: https://github.com/percona/percona-toolkit/pull/609
This is fixed in Percona Toolkit 3.5.2 that switched to Go 1.20.
Thank you for the response!
When can we expect a newer version of the toolkit with the CVE fixes be published?
As per latest twistlock scan results, two new vulnerabilities were detected:
CVE-2022-41724
CVE-2022-41725
Can these CVEs also get addressed as a part of the fix.
I have updated the description and report in attachment, accordingly.
Thank you for the report.
We fixed few CVEs in GitHub recently. See https://github.com/percona/percona-toolkit/pull/600 for details. We will review issues you reported in case if your list has extra. Right now, you can download binaries with the fix from https://github.com/percona/percona-toolkit/actions/runs/4244707781
We install the toolkit from the Percona website.
Software link: https://downloads.percona.com/downloads/percona-toolkit/3.5.1/binary/tarball/percona-toolkit-3.5.1_x86_64.tar.gz
After installing the software and scanning the image with Twistlock gives us the below list of CVEs.
Can we expect a newer tar gz for Linux OS be published and when?
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
* CVE *
SEVERITY
CVSS
PACKAGE
VERSION
STATUS
PUBLISHED
DISCOVERED
* DESCRIPTION *
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-41715
high
7.50
go
1.18.3
fixed in 1.19.2, 1.18.7
> 4 months
< 1 hour
Programs which compile regular expressions from
> 4 months ago
untrusted sources may be vulnerable to memory
exhaustion or denial of service. The parsed regexp
repre...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-32190
high
7.50
go
1.18.3
fixed in 1.18.6
> 5 months
< 1 hour
JoinPath and URL.JoinPath do not remove ../ path
> 5 months ago
elements appended to a relative path. For example,
JoinPath(\"https://go.dev\", \"../go\") returns
th...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-32189
high
7.50
go
1.18.3
fixed in 1.18.5, 1.17.13
> 6 months
< 1 hour
A too-short encoded message can cause a panic in
> 6 months ago
Float.GobDecode and Rat GobDecode in math/big in
Go before 1.17.13 and 1.18.5, potentially allowing
a...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-30635
high
7.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Uncontrolled recursion in Decoder.Decode in
> 6 months ago
encoding/gob before Go 1.17.12 and Go 1.18.4
allows an attacker to cause a panic due to stack
exhaustion v...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-30633
high
7.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Uncontrolled recursion in Unmarshal in
> 6 months ago
encoding/xml before Go 1.17.12 and Go 1.18.4
allows an attacker to cause a panic due to stack
exhaustion via un...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-30632
high
7.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Uncontrolled recursion in Glob in path/filepath
> 6 months ago
before Go 1.17.12 and Go 1.18.4 allows an attacker
to cause a panic due to stack exhaustion via a
path...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-30631
high
7.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Uncontrolled recursion in Reader.Read in
> 6 months ago
compress/gzip before Go 1.17.12 and Go 1.18.4
allows an attacker to cause a panic due to stack
exhaustion via...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-30630
high
7.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Uncontrolled recursion in Glob in io/fs before Go
> 6 months ago
1.17.12 and Go 1.18.4 allows an attacker to cause
a panic due to stack exhaustion via a path which
c...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-2880
high
7.50
go
1.18.3
fixed in 1.19.2, 1.18.7
> 4 months
< 1 hour
Requests forwarded by ReverseProxy include the
> 4 months ago
raw query parameters from the inbound request,
including unparseable parameters rejected by
net/http. T...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-2879
high
7.50
go
1.18.3
fixed in 1.19.2, 1.18.7
> 4 months
< 1 hour
Reader.Read does not set a limit on the maximum
> 4 months ago
size of file headers. A maliciously crafted
archive could cause Read to allocate unbounded
amounts of ...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-28131
high
7.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Uncontrolled recursion in Decoder.Skip in
> 6 months ago
encoding/xml before Go 1.17.12 and Go 1.18.4
allows an attacker to cause a panic due to stack
exhaustion via...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-27664
high
7.50
go
1.18.3
fixed in 1.19.1, 1.18.6
> 5 months
< 1 hour
In net/http in Go before 1.18.6 and 1.19.x before
> 5 months ago
1.19.1, attackers can cause a denial of service
because an HTTP/2 connection can hang during
closing...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-32148
medium
6.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Improper exposure of client IP addresses
> 6 months ago
in net/http before Go 1.17.12 and Go
1.18.4 can be triggered by calling
httputil.ReverseProxy.ServeHTTP with ...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-1705
medium
6.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Acceptance of some invalid Transfer-Encoding
> 6 months ago
headers in the HTTP/1 client in net/http before
Go 1.17.12 and Go 1.18.4 allows HTTP request
smuggling if...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-1962
medium
5.50
go
1.18.3
fixed in 1.18.4, 1.17.12
> 6 months
< 1 hour
Uncontrolled recursion in the Parse functions in
> 6 months ago
go/parser before Go 1.17.12 and Go 1.18.4 allow an
attacker to cause a panic due to stack exhaustion
...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-41716
medium
5.40
go
1.18.3
fixed in 1.19.3, 1.18.8
> 3 months
< 1 hour
Due to unsanitized NUL values, attackers may be
> 3 months ago
able to maliciously set environment variables on
Windows. In syscall.StartProcess and os/exec.Cmd,
inv...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-41717
medium
5.30
go
1.18.3
fixed in 1.19.4, 1.18.9
74 days
< 1 hour
An attacker can cause excessive memory growth in a
70 days ago
Go server accepting HTTP/2 requests. HTTP/2 server
connections contain a cache of HTTP header keys
...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2022-41723
low
1.00
golang.org/x/net
v0.4.0
fixed in 0.7.0
4 days
< 1 hour
A maliciously crafted HTTP/2 stream could cause
4 days ago
excessive CPU consumption in the HPACK decoder,
sufficient to cause a denial of service from a
small n...
-----------------------------------------------------------------------------------------------------------------------------------------------------------------