CVE-2022-2879: 
Docker vulnerability analysis and mitigation

CVE-2022-2879 is a vulnerability in Go's archive/tar package discovered in 2022. The issue stems from Reader.Read not setting a limit on the maximum size of file headers. This vulnerability was reported by Adam Korczynski from ADA Logics and OSS-Fuzz (Golang Announce).

The vulnerability exists in the archive/tar package where Reader.Read did not implement size limitations for file headers. This could allow a maliciously crafted archive to cause unbounded memory allocation. The issue has a CVSS 3.1 base score of 7.5 (High), with attack vector being Network, attack complexity Low, and requiring no privileges or user interaction (Ubuntu CVE). After the fix, Reader.Read now limits the maximum size of header blocks to 1 MiB (Go Issue).

The vulnerability could lead to resource exhaustion or system panics when processing maliciously crafted archive files. The impact primarily affects availability with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability has been fixed in Go versions 1.19.2 and 1.18.7. Users are advised to upgrade to these or later versions. The fix implements a 1 MiB limit on the maximum size of header blocks in Reader.Read (Golang Announce).