golang1.19.13 has some vulnerabilities

[ljw4010]

Summary

golang1.19.13 has some High level vulnerabilities

Details

 "PkgName": "stdlib",
          "PkgIdentifier": {
            "PURL": "pkg:golang/[email protected]",
            "UID": "6f07c620dd5d7a15"
          },
          "InstalledVersion": "1.22.0",
          "FixedVersion": "1.22.7, 1.23.1",
          "Status": "fixed",
          "Layer": {},
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-34156",
          "DataSource": {
            "ID": "govulndb",
            "Name": "The Go Vulnerability Database",
            "URL": "https://pkg.go.dev/vuln/"
          },
          "Title": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion",
          "Description": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.",
          "Severity": "HIGH",
          "VendorSeverity": {
            "bitnami": 3,
            "redhat": 3
          },
          "CVSS": {
            "bitnami": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2024-34156",
            "https://go.dev/cl/611239",
            "https://go.dev/issue/69139",
            "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
            "https://nvd.nist.gov/vuln/detail/CVE-2024-34156",
            "https://pkg.go.dev/vuln/GO-2024-3106",
            "https://www.cve.org/CVERecord?id=CVE-2024-34156"
          ],
          "PublishedDate": "2024-09-06T21:15:12.02Z",
          "LastModifiedDate": "2024-09-09T15:35:07.573Z"
        }
      ]
    }
  ]

• CVE-2024-24790
• CVE-2023-45287
• CVE-2024-34156

PoC

refer to Details

Impact

refer to Details