aws / eks-distro-build-tooling

This repository contains tooling used to build the EKS Distro, and all the projects contained in https://github.com/aws/eks-distro.

Home Page:https://distro.eks.amazonaws.com/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

go/parser: infinite loop in parsing (CVE-2023-24537)

eks-distro-pr-bot opened this issue · comments

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Thanks to Philippe Antoine (Catena cyber) for reporting this issue.

This is CVE-2023-24537 and Go issue https://go.dev/issue/59180.

/cc @golang/security and @golang/release

This CVE fix is backported to 1.15-1.18.
go1.18: #941
go1.17: #942
go1.16: #949
go1.15: #957