CVE-2022-28131: 
Grafana vulnerability analysis and mitigation

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. The vulnerability was discovered by the Go Security team and independently reported by Juho Nurminen of Mattermost, and was assigned CVE-2022-28131 (MITRE, NVD).

The vulnerability exists in the encoding/xml package's Decoder.Skip functionality when processing deeply nested XML documents. The issue stems from uncontrolled recursion that can lead to stack exhaustion. The vulnerability has a CVSS 3.1 Base Score of 7.5 (High), with attack vector being Network, attack complexity Low, and requiring no privileges or user interaction (Ubuntu).

When exploited, this vulnerability can cause a denial of service through application panic due to stack exhaustion. The impact is primarily on availability, with no direct effect on confidentiality or integrity of the system (Ubuntu).

The vulnerability has been fixed in Go versions 1.17.12 and 1.18.4. The fix involves using an iterative approach for Skip rather than a recursive one to prevent stack exhaustion in deeply nested structures. Users should upgrade to these or later versions to mitigate the vulnerability (Golang Announce).