CVE-2022-27664
Aliases:GHSA-69cg-p879-7622BIT-golang-2022-27664GO-2022-0969RHBA-2023:0564RHSA-2023:2177RHSA-2023:2785RHSA-2023:4674RHSA-2023:4734DEBIAN-CVE-2022-27664CGA-2g3j-5qm7-rcrpCGA-2g7c-vgph-h32hCGA-2mjr-xww4-jhvfCGA-3mhm-p6rm-x38wCGA-3r9h-mchf-ffwqCGA-47g5-853p-2hmcCGA-55hc-gj86-rc5mCGA-57cf-rm46-6v7mCGA-5vjh-f3xw-r3rhCGA-6j5r-499x-j4g8CGA-6rrp-25xq-6fh2CGA-6vjv-fr8p-8f4jCGA-795g-38x5-jx44CGA-7c2x-g2hf-8p82CGA-98x2-fg46-fmwqCGA-9937-6cqx-9275CGA-c7w6-6555-2j74CGA-c9jg-55hr-763cCGA-chqm-xg3h-fvhrCGA-crh6-5w4v-7cfxCGA-cxjh-4pcr-648mCGA-f9fr-jhrj-mxmhCGA-fqfx-xf59-mvjfCGA-fx8g-q5q5-fff6CGA-g5gx-vgv9-4jg8CGA-gvmf-w63q-vrrcCGA-h645-ggqq-qvx7CGA-hhg9-4rpp-6xwrCGA-hj22-5wx3-c25xCGA-j4f6-c88v-hm7wCGA-jc7w-fcqr-x54qCGA-jh3j-r4rp-rv24CGA-jhvh-4jgj-rw7jCGA-jrfr-939x-732xCGA-jrhp-9mq9-jh84CGA-m5mg-932j-gf46CGA-mhc7-wh9v-gqwwCGA-mmm9-phhv-9pghCGA-p8r5-99rx-75xvCGA-pqh4-x3vp-c27hCGA-359x-hfvh-xv63CGA-3cqv-8j78-hmj8CGA-495c-jv2p-9788CGA-4f9v-5pf3-8f56CGA-4fj7-g938-xv37CGA-56vv-v554-mm72CGA-5qv2-639f-vf8qCGA-66fg-vcq4-7rr8CGA-69qj-x3hm-86m8CGA-6m6c-89hw-hq86CGA-72qr-3jh4-3hrrCGA-8445-jw2q-3x6cCGA-99gm-3j5g-752vCGA-9r8j-qpcg-5x84CGA-c29q-vqwr-r3xfCGA-cp3v-g96r-vrx9CGA-fq4j-p9w3-gjcvCGA-fr23-fjqw-f5v3CGA-h5m8-g4h8-fghgCGA-hvfh-wx56-874qCGA-m44p-6wh9-j37rCGA-m5f4-26r7-2mj9CGA-p2vq-w7wq-9xc6CGA-p55m-w85v-q4jjCGA-pj9f-jjpc-m79hCGA-pp5v-vjf3-hxf6CGA-pxcc-pjpq-9m9jCGA-qhf6-cvfc-hgwvCGA-qq24-w8jx-9g76CGA-qr2v-f58q-8mr7CGA-r2pw-3qxr-qq8gCGA-r3xf-mj8f-c356CGA-r499-85g2-h277CGA-rjmq-qqqx-rrhxCGA-rqg4-vg9h-2w5cCGA-v695-q63j-vf9gCGA-vfxj-5m3g-rpmgCGA-vpcq-m4xr-qp4cCGA-vv32-qr88-xvfrCGA-vwc5-wppf-q38hCGA-w2rh-7rw7-w6ppCGA-w62q-9q33-97r4CGA-w6qv-xf4w-5r9vCGA-wchm-jww9-7gm8CGA-wfhj-76cc-xc4pCGA-wh65-xww5-x2p5CGA-wm5j-jhh4-rcrmCGA-wp4c-2wxv-3g4gCGA-wrfg-cq9c-5wp6CGA-wrjv-5fwf-v4q6CGA-wrpc-5q2h-c79gCGA-ww65-qgqq-p6cxCGA-x6c4-2m2c-8fh9CGA-xh68-pqjp-qr4vCGA-h3wg-w9mg-5ghxCGA-mfgr-r88f-32xv
Advisory lineage Upstream: 0 Downstream: 52
Modified
Published: 06 Sept 2022, 17:29
Last modified:03 Aug 2024, 05:32
Vulnerability Summary
Overall Risk (default)
medium
31/100 CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
3.27% LOW
3% probability +3.17%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
06 Sept 2022, 17:29
Published
Vulnerability first disclosed
03 Aug 2024, 05:32
Last Modified
Vulnerability information updated
Description
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 3.27%• Percentile: 88%
Affected Systems
- chainguard•dynamic-localpv-provisioner
< 3.4.1-r3
- chainguard•dynamic-localpv-provisioner-fips
< 3.5.0-r0
- chainguard•grpcurl
< 1.8.7-r7
- chainguard•hey
< 0.1.4-r3
- chainguard•k3d
< 5.6.0-r11
- chainguard•k3d-proxy
< 5.6.0-r11
- chainguard•k3d-tools
< 5.6.0-r11
- chainguard•katib-earlystopping
< 0.19.0-r31
- chainguard•katib-suggestion-goptuna-compat
all
- chainguard•katib-suggestion-hyperband
< 0.19.0-r31
- chainguard•katib-suggestion-hyperopt
< 0.19.0-r31 | < 0.19.0-r40
- chainguard•katib-suggestion-nas-darts
< 0.19.0-r31
- chainguard•katib-suggestion-nas-enas
< 0.19.0-r31
- chainguard•katib-suggestion-optuna-enas
< 0.19.0-r31
- chainguard•katib-suggestion-pbt-enas
< 0.19.0-r31
- chainguard•katib-suggestion-skopt-enas
< 0.19.0-r31
- chainguard•katib-tfevent-metricscollector
< 0.19.0-r31
- chainguard•kube-state-metrics-2.6
< 2.6.0-r1
- chainguard•kubeflow
< 1.10.0-r4
- chainguard•kubeflow-access-management
< 1.10.0-r4
- chainguard•kubeflow-access-management-compat
< 1.10.0-r4
- chainguard•kubeflow-access-management-fips
< 1.10.0-r2
- chainguard•kubeflow-access-management-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook
< 1.10.0-r4
- chainguard•kubeflow-admission-webhook-compat
< 1.10.0-r4
- chainguard•kubeflow-admission-webhook-fips
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller
< 1.10.0-r4
- chainguard•kubeflow-notebook-controller-compat
< 1.10.0-r4
- chainguard•kubeflow-notebook-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-profile-controller
< 1.10.0-r4
- chainguard•kubeflow-profile-controller-compat
< 1.10.0-r4
- chainguard•kubeflow-profile-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-profile-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-pvcviewer-controller
< 1.10.0-r4
- chainguard•kubeflow-pvcviewer-controller-compat
< 1.10.0-r4
- chainguard•kubeflow-pvcviewer-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-pvcviewer-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-tensorboard-controller
< 1.10.0-r4
- chainguard•kubeflow-tensorboard-controller-compat
< 1.10.0-r4
- chainguard•kubeflow-tensorboard-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-tensorboard-controller-fips-compat
< 1.10.0-r2
- chainguard•prometheus-postgres-exporter-0.10
< 0
- chainguard•terraform-provider-sendgrid
< 1.0.1-r1
- chainguard•terraform-provider-sendgrid-fips
< 1.0.1-r1
- chainguard•wireguard-go
< 0.0.20230223-r7
- wolfi•dynamic-localpv-provisioner
< 3.4.1-r3
- wolfi•grpcurl
< 1.8.7-r7
Showing first 50 affected entries in server-rendered view.
References (35)
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/x49AQzIVX-s
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/
- https://security.netapp.com/advisory/ntap-20220923-0004/
- https://security.gentoo.org/glsa/202209-26
- https://nvd.nist.gov/vuln/detail/CVE-2022-27664
- https://cs.opensource.google/go/x/net
- https://go.dev/cl/428735
- https://go.dev/issue/54658
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX
- https://pkg.go.dev/vuln/GO-2022-0969
- https://security.netapp.com/advisory/ntap-20220923-0004
- https://access.redhat.com/errata/RHBA-2023:0564
- https://issues.redhat.com/browse/OCPBUGS-6896
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_0564.json
- https://access.redhat.com/security/cve/CVE-2022-27664
- https://bugzilla.redhat.com/show_bug.cgi?id=2124669
- https://www.cve.org/CVERecord?id=CVE-2022-27664
- https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ
- https://access.redhat.com/errata/RHSA-2023:2177
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
- https://bugzilla.redhat.com/show_bug.cgi?id=2127038
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2177.json
- https://access.redhat.com/errata/RHSA-2023:2785
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2785.json
- https://access.redhat.com/errata/RHSA-2023:4674
- https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4674.json
- https://access.redhat.com/errata/RHSA-2023:4734
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4734.json
- https://security-tracker.debian.org/tracker/CVE-2022-27664