CVE-2024-45338
Vulnerability Summary
Timeline
Description
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
CVSS Metrics
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Trends
Current EPSS score: 0.87%• Percentile: 57%
Techniques & Countermeasures
- CWE-1333•Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Systems
- chainguard•aactl
< 0.4.12-r21
- chainguard•actions-runner-controller
< 0.10.1-r1
- chainguard•actions-runner-controller-compat
< 0.10.1-r1
- chainguard•actions-runner-controller-fips
< 0.10.1-r1
- chainguard•addon-resizer
< 1.8.22-r4
- chainguard•addon-resizer-compat
< 1.8.22-r4
- chainguard•addon-resizer-fips
< 1.8.22-r3
- chainguard•addon-resizer-fips-compat
< 1.8.22-r3
- chainguard•amass
< 4.2.0-r15
- chainguard•amazon-cloudwatch-agent
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-all
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-compat
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-config-downloader
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-config-translator
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-fips
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-operator
< 2.0.1-r1
- chainguard•amazon-cloudwatch-agent-operator-compat
< 2.0.1-r1
- chainguard•amazon-cloudwatch-agent-operator-fips
< 2.0.1-r1
- chainguard•amazon-cloudwatch-agent-operator-fips-compat
< 2.0.1-r1
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent
< 1.300051.0-r2
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 1.300051.0-r2
- chainguard•amazon-k8s-cni
< 1.19.0-r1
- chainguard•amazon-k8s-cni-compat
< 1.19.0-r1
- chainguard•amazon-k8s-cni-fips
< 1.19.0-r1
- chainguard•amazon-k8s-cni-init
< 1.19.0-r1
- chainguard•amazon-k8s-cni-init-compat
< 1.19.0-r1
- chainguard•amazon-k8s-cni-init-fips
< 1.19.0-r1
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.19.0-r1
- chainguard•amazon-ssm-agent
< 3.3.1957.0-r5
- chainguard•amazon-ssm-agent-ecs-exec
< 3.3.1957.0-r5
- chainguard•ansible-operator
< 1.37.0-r1
- chainguard•ansible-operator-compat
< 1.37.0-r1
- chainguard•apache-beam-java-11-sdk
< 2.61.0-r1
- chainguard•apache-beam-java-17-sdk
< 2.61.0-r1
- chainguard•apache-beam-java-21-sdk
< 2.61.0-r1
- chainguard•apache-beam-java-sdk
< 2.61.0-r1
- chainguard•apache-beam-python-3.11-sdk
< 2.61.0-r1
- chainguard•apko
< 0.25.5-r0
- chainguard•argo-cd-2.11
< 2.11.12-r2
- chainguard•argo-cd-2.13
< 2.13.2-r2
- chainguard•argo-cd-2.13-compat
< 2.13.2-r2
- chainguard•argo-cd-2.13-repo-server
< 2.13.2-r2
- chainguard•argo-events
< 1.9.3-r2
- chainguard•argo-events-fips
< 1.9.3-r2
- chainguard•argo-rollouts
< 1.7.2-r3
- chainguard•argo-rollouts-fips
< 1.7.2-r3
Showing first 50 affected entries in server-rendered view.
References (9)
- https://go.dev/cl/637536
- https://go.dev/issue/70906
- https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
- https://pkg.go.dev/vuln/GO-2024-3333
- https://security.netapp.com/advisory/ntap-20250221-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338
- https://github.com/golang/go/issues/70906
- https://cs.opensource.google/go/x/net
- https://security-tracker.debian.org/tracker/CVE-2024-45338