CVE-2022-29804
Fixed in a distro release EPSS 2%
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
Products: Go standard library path/filepath
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | stdlib | 1.17.11 |
| Go | stdlib | 1.18.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Enterprise Storage 7.1 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | go1.17 | 1.17.11-150000.1.37.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | go1.18 | 1.18.3-150000.1.20.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.17 | 1.17.11-150000.1.37.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.18 | 1.18.3-150000.1.20.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| openSUSE Leap 15.3 | go1.17 | 1.17.11-150000.1.37.1 |
| openSUSE Leap 15.3 | go1.18 | 1.18.3-150000.1.20.1 |
| openSUSE Leap 15.4 | go1.17 | 1.17.11-150000.1.37.1 |
| openSUSE Leap 15.4 | go1.18 | 1.18.3-150000.1.20.1 |
| openSUSE Leap 15.4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| openSUSE Leap 15.5 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| openSUSE Tumbleweed | go1.17 | 1.17.11-1.1 |
| openSUSE Tumbleweed | go1.18 | 1.18.3-1.1 |