CVE-2022-24675: 
cAdvisor vulnerability analysis and mitigation

CVE-2022-24675 affects encoding/pem in Go versions before 1.17.9 and 1.18.x before 1.18.1. The vulnerability was discovered by Juho Nurminen of Mattermost and disclosed in April 2022. The vulnerability affects the PEM decoding functionality in Go's encoding/pem package (Golang Announce).

The vulnerability is a stack overflow condition in the Decode function of Go's encoding/pem package. The issue occurs when processing large PEM input data exceeding 5 MB in size, which can trigger a stack overflow condition leading to program crashes (Red Hat CVE). The vulnerability has been assigned a CVSS score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

When successfully exploited, this vulnerability can lead to Denial of Service (DoS) by causing the affected program to crash through a stack overflow when processing maliciously crafted PEM input data (NetApp Advisory).

The vulnerability has been fixed in Go versions 1.17.9 and 1.18.1. Users should upgrade to these or later versions to address the issue. The fix was released in April 2022 as part of the security updates (Golang Announce).