CVE-2024-34158

Description

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.05%• Percentile: 63%

Techniques & Countermeasures

• CWE-674•Uncontrolled Recursion

  The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Systems

• chainguard•aactl

  < 0.4.12-r18

• chainguard•actions-runner-controller

  < 0.9.3-r2

• chainguard•actions-runner-controller-compat

  < 0.9.3-r2

• chainguard•actions-runner-controller-fips

  < 0.9.3-r2

• chainguard•actions-runner-controller-fips-compat

  < 0.9.3-r2

• chainguard•addon-resizer

  < 1.8.22-r2

• chainguard•addon-resizer-compat

  < 1.8.22-r2

• chainguard•addon-resizer-fips

  < 1.8.22-r2

• chainguard•addon-resizer-fips-compat

  < 1.8.22-r2

• chainguard•age

  < 1.2.0-r2

• chainguard•amass

  < 4.2.0-r13

• chainguard•apache-beam-java-11-sdk

  < 2.63.0-r1

• chainguard•apache-beam-java-17-sdk

  < 2.63.0-r1

• chainguard•apache-beam-java-21-sdk

  < 2.63.0-r1

• chainguard•apache-beam-java-sdk

  < 2.63.0-r1

• chainguard•apache-beam-python-3.11-sdk

  < 2.58.1-r1

• chainguard•apko

  < 0.18.0-r0

• chainguard•argo-cd-2.11

  < 2.11.8-r0

• chainguard•argo-workflows

  < 3.6.5-r2

• chainguard•argo-workflows-fips

  < 3.6.5-r2

• chainguard•atlantis

  < 0.29.0-r1

• chainguard•atlantis-fips

  < 0.29.0-r1

• chainguard•authservice

  < 1.0.2-r0

• chainguard•authservice-fips

  < 1.0.1-r2

• chainguard•authservice-fips-compat

  < 1.0.1-r2

• chainguard•aws-ebs-csi-driver

  < 1.34.0-r1

• chainguard•aws-efs-csi-driver

  < 2.0.7-r1

• chainguard•aws-efs-csi-driver-fips

  < 2.0.7-r1

• chainguard•aws-flb-cloudwatch

  < 1.9.4-r13

• chainguard•aws-flb-cloudwatch-compat

  < 1.9.4-r13

• chainguard•aws-flb-cloudwatch-compat-fips

  < 1.9.4-r6

• chainguard•aws-flb-cloudwatch-fips

  < 1.9.4-r6

• chainguard•aws-flb-firehose

  < 1.7.2-r13

• chainguard•aws-flb-firehose-compat

  < 1.7.2-r13

• chainguard•aws-flb-firehose-compat-fips

  < 1.7.2-r6

• chainguard•aws-flb-firehose-fips

  < 1.7.2-r6

• chainguard•aws-flb-kinesis

  < 1.10.2-r14

• chainguard•aws-flb-kinesis-compat

  < 1.10.2-r14

• chainguard•aws-flb-kinesis-compat-fips

  < 1.10.2-r7

• chainguard•aws-flb-kinesis-fips

  < 1.10.2-r7

• chainguard•aws-load-balancer-controller

  < 2.8.2-r1

• chainguard•aws-load-balancer-controller-compat

  < 2.8.2-r1

• chainguard•aws-load-balancer-controller-fips

  < 2.8.2-r2

• chainguard•aws-network-policy-agent

  < 1.1.2-r2

• chainguard•aws-network-policy-agent-compat

  < 1.1.2-r2

• chainguard•azcopy

  < 10.26.0-r1

• chainguard•azcopy-fips

  < 10.26.0-r1

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r12

• chainguard•azure-aad-pod-identity-nmi

  < 1.8.17-r12

• chainguard•bank-vaults

  < 1.20.4-r18

Showing first 50 affected entries in server-rendered view.

References (6)

• https://go.dev/cl/611240
• https://go.dev/issue/69141
• https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
• https://pkg.go.dev/vuln/GO-2024-3107
• https://security.netapp.com/advisory/ntap-20241004-0003/
• https://security-tracker.debian.org/tracker/CVE-2024-34158