Approved changes feed: RSS · Atom
cpe:2.3:a:pandatix:go-cvss:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pandatix (eabd328a-96d2-5e7f-8246-0d209a7fcd7b) |
|---|---|
| Product | Go Cvss (d9914cb1-f108-5600-82c9-a1f6811db995) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pandatix/go-cvss |
purl2cpe | 2026-06-01 10:13:29.422083 |
pkg:golang/github.com/pandatix/go-cvss |
purl2cpe | 2026-06-01 10:13:29.422085 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-39213 |
vulnerable | 2026-06-08 05:47:18.357390 |
Out-of-bounds Read in go-cvss
HIGH (7.5)
go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag `v0.4.0`, by the commit `d9d478ff0c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined (e.g. `AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M`). As stated in [SECURITY.md](https://github.com/pandatix/go-cvss/blob/master/SECURITY.md), the CPE v2.3 to refer to this Go module is `cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*`. The entry has already been requested to the NVD CPE dictionary.
Published: 2022-09-15T21:45:12.000Z
Updated: 2025-04-22T17:21:23.908Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.