CVE-2022-3064 json
Excessive resource consumption in gopkg.in/yaml.v2
published 4y ago modified last mo. also GHSA-6q6q-88xp-6f2r , GO-2022-0956 , EUVD-2022-7537
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
Patch / fix
- go gopkg.in/yaml.v2 2.2.4
- gopkg.in/yaml.v2 gopkg.in/yaml.v2 2.2.4
- golang-yaml.v2 Debian 14, Debian 13, Debian 12 2.2.8-1
debian advisories DEBIAN-CVE-2022-3064
- golang-yaml.v2 Ubuntu 20.04 LTS 2.2.2-1ubuntu0.1
- golang-yaml.v2 Ubuntu Pro 16.04 LTS 0.0+git20160301.0.a83829b-1ubuntu0.1~esm1
- golang-yaml.v2 Ubuntu Pro 18.04 LTS 0.0+git20170407.0.cd8b52f-1ubuntu2+esm1
ubuntu advisories UBUNTU-CVE-2022-3064
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- rhc RHEL 8 1:0.2.5-1.el8_10
- rhc RHEL 9 1:0.2.5-1.el9_5
- crit RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
- criu RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
- crun RHEL 8 1.8.3-1.module+el8.9.0+19098+6e7a5e3f
- runc RHEL 8 1:1.1.5-2.module+el8.9.0+19104+fcef53a3
- udica RHEL 8 0.2.6-4.module+el8.9.0+19098+6e7a5e3f
- conmon RHEL 8 2:2.1.4-2.module+el8.9.0+19098+6e7a5e3f
red hat advisories RHSA-2024:10784RHSA-2024:10759RHSA-2023:6938RHSA-2023:6939RHSA-2023:6346RHSA-2024:4443
- crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
- crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
- criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
- criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
- crun AlmaLinux 8 1.8.3-1.module_el8.9.0+3627+db8ec155
- runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
- udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
- conmon AlmaLinux 8 2:2.1.4-2.module_el8.9.0+3627+db8ec155
almalinux advisories ALSA-2023:6938ALSA-2023:6939ALSA-2023:6346
- criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
- crun Rocky Linux 8 1.8.3-1.module+el8.9.0+1445+07728297
- runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
- udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
- conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
- podman Rocky Linux 8 2:4.0.2-24.module+el8.9.0+1445+07728297
- buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
- libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
rocky linux advisories RLSA-2023:6938RLSA-2023:6939
- packer Azure Linux 3.0 1.9.5-1
- buildah Azure Linux 3.0 1.41.4-2
- podman Azure Linux 3.0 5.6.1-2
azure linux advisories AZL-40841AZL-44514AZL-44610
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/go-yaml/yaml@f221b84 commit
- github.com/go-yaml/yaml/releases/tag/v2.2.4 release
- pkg.go.dev/vuln/GO-2022-0956 advisory
Is CVE-2022-3064 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-3064 updated cvss 7.5
go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents
-
Red Hat Cryostat 2 cryostat-tech-preview/cryostat-rhel8-operator Red Hat OpenShift Serverless cliaffected: no fix planned “Will not fix”
-
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/config-policy-controller-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-scanner-db-rhel8, advanced-cluster-security/rhacs-scanner-slim-rhel8affected: no fix available
-
Red Hat Enterprise Linux 7 rhc, skopeoaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 toolbox, toolbox-testsaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux 9 butaneaffected: no fix available
-
Red Hat OpenShift Container Platform 3.11 podman, cri-tools, atomic-openshift, atomic-openshift-pod, atomic-openshift-node, ansible-service-broker, +22 moreaffected: no fix planned “Out of support scope”
-
Red Hat OpenShift Container Platform 4 butane, prometheus-promu, butane-redistributable, openshift4/ose-ghostunnel, openshift-prometheus-promu, atomic-openshift-service-idler, +5 more Red Hat OpenShift GitOps openshift-gitops-1/applicationset-rhel8 Red Hat OpenStack Platform 16.1 golang-gopkg-yaml-devel-v2 Red Hat OpenStack Platform 16.2 golang-gopkg-yaml-devel-v2 Red Hat Quay 3 quay/quay-rhel8 Red Hat Storage 3 rhgs3/rhgs-gluster-block-prov-rhel7affected: no fix available
-
Red Hat Enterprise Linux 10 rhcunder investigation
show 17 moreshow fewer
-
Red Hat CodeReady Linux Builder (v. 9) rhc-devel 0.2.5-1.el9_5, rhc-debuginfo 0.2.5-1.el9_5, rhc-debugsource 0.2.5-1.el9_5fixed: vendor fix RHSA-2024:10759
-
Red Hat Enterprise Linux AppStream (v. 8) rhc 0.2.5-1.el8_10, crit 3.15-3.module+el8.9.0+19243+df4d9ff2, crit 3.18-4.module+el8.9.0+19090+d2921118, criu 3.15-3.module+el8.9.0+19243+df4d9ff2, criu 3.18-4.module+el8.9.0+19090+d2921118, crun 1.8.3-1.module+el8.9.0+19098+6e7a5e3f, +61 morefixed: vendor fix RHSA-2024:10784
-
Red Hat Enterprise Linux AppStream (v. 9) rhc 0.2.5-1.el9_5, toolbox 0.0.99.4-6.el9_3, toolbox-tests 0.0.99.4-6.el9_3fixed: vendor fix RHSA-2023:6346
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) toolbox 0.0.99.4-1.el9_2, toolbox-tests 0.0.99.4-1.el9_2fixed: vendor fix RHSA-2024:4443
-
Red Hat OpenShift Container Platform 4.9 openshift4/ose-configmap-reloader v4.9.0-202302111027.p0.gc041899.assembly.streamfixed: vendor fix RHSA-2023:0778
-
Red Hat OpenShift Container Platform 4.10 openshift4/ose-sriov-cni v4.10.0-202305101928.p0.gc574bbb.assembly.stream, openshift4/ose-telemeter v4.10.0-202302201054.p0.g3b5eb87.assembly.stream, openshift4/ose-configmap-reloader v4.10.0-202302072301.p0.g1e5a18e.assembly.streamfixed: vendor fix RHSA-2023:0698
-
Red Hat OpenShift Container Platform 4.11 openshift4/ose-sriov-cni v4.11.0-202305081228.p0.g71764f5.assembly.streamfixed: vendor fix RHSA-2023:2695
-
Red Hat OpenShift Container Platform 4.12 openshift4/ose-sriov-cni v4.12.0-202305022015.p0.g1876528.assembly.streamfixed: vendor fix RHSA-2023:2111
-
Red Hat OpenShift Container Platform 4.13 openshift4/egress-router-cni-rhel8 v4.13.0-202402061238.p0.gdfe0373.assembly.stream.el8fixed: vendor fix RHSA-2024:0741
-
Red Hat OpenShift Container Platform 4.14 openshift4/egress-router-cni-rhel8 v4.14.0-202310201027.p0.gafffdd4.assembly.streamfixed: vendor fix RHSA-2023:5006
-
Red Hat OpenShift Dev Spaces 3 devspaces/configbump-rhel8 3.15-2fixed: vendor fix RHSA-2024:4631
-
Red Hat OpenShift GitOps 1.5 openshift-gitops-1/argocd-rhel8 v1.5.10-6fixed: vendor fix RHSA-2023:0804
-
Red Hat OpenShift GitOps 1.6 openshift-gitops-1/argocd-rhel8 v1.6.5-5fixed: vendor fix RHSA-2023:0802
-
Red Hat OpenShift GitOps 1.7 openshift-gitops-1/argocd-rhel8 v1.7.2-5fixed: vendor fix RHSA-2023:0803
-
Red Hat OpenStack Platform 16.1 etcd 3.3.23-12.el8ost Red Hat OpenStack Platform 16.2 etcd 3.3.23-12.el8ostfixed: vendor fix RHSA-2023:1275
-
Red Hat OpenStack Platform 17.0 etcd 3.4.14-3.el9ostfixed: vendor fix RHSA-2023:1014
-
Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/eventrouter-rhel9, openshift-logging/logging-loki-rhel9, openshift-logging/opa-openshift-rhel8, openshift-logging/lokistack-gateway-rhel8, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, +2 more Red Hat Migration Toolkit for Applications 6 mta/mta-hub-rhel8, mta/mta-admin-addon-rhel8, mta/mta-windup-addon-rhel8 Red Hat Migration Toolkit for Containers rhmtc/openshift-velero-plugin-rhel8, rhmtc/openshift-migration-velero-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8, +2 more Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9, migration-toolkit-virtualization/mtv-must-gather-api-rhel8not affected: vulnerable code not present
+2 more productsfewer
Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat Network Observability Operator network-observability/network-observability-rhel9-operator, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9
48 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
1.87% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | gopkg.in/yaml.v2 | <2.2.4 |
2.2.4 |
Affected products
- gopkg.in/yaml.v2 gopkg.in/yaml.v2
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5
web, patch, third-party-advisory
-
pkg.go.dev
/vuln/GO-2022-0956
web, patch, vendor-advisory
-
github.com
/go-yaml/yaml/releases/tag/v2.2.4
web, release-notes, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2023/07/msg00001.html
web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/
-
nvd.nist.gov
/vuln/detail/CVE-2022-3064
advisory
-
github.com
/go-yaml/yaml
package
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
web
Sources
- CVE List CVE-2022-3064
- GitHub Advisory GHSA-6q6q-88xp-6f2r
- NVD CVE-2022-3064
- OSV GO-2022-0956
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.