CVE-2022-27664 : In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Published 2022-09-06 18:15:13

Updated 2022-10-28 12:42:35

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2022-27664

Fedoraproject » Fedora » Version: 36
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Matching versions
Golang » GO
Versions before (<) 1.18.6
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Matching versions
Golang » GO » Version: 1.19.0
cpe:2.3:a:golang:go:1.19.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-27664

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 62 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-27664

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2022-27664

https://security.netapp.com/advisory/ntap-20220923-0004/

CVE-2022-27664 Golang Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://groups.google.com/g/golang-announce/c/x49AQzIVX-s

[security] Go 1.19.1 and Go 1.18.6 are released
Mailing List;Release Notes;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/

[SECURITY] Fedora 36 Update: golang-1.18.6-1.fc36 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://groups.google.com/g/golang-announce

golang-announce - Google Groups
Mailing List;Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202209-26

Go: Multiple Vulnerabilities (GLSA 202209-26) — Gentoo security
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/

[SECURITY] Fedora 37 Update: golang-1.19.1-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-27664

Products affected by CVE-2022-27664

Exploit prediction scoring system (EPSS) score for CVE-2022-27664

CVSS scores for CVE-2022-27664

References for CVE-2022-27664