CVE-2022-32149: 
Terraform Community vulnerability analysis and mitigation

CVE-2022-32149 is a vulnerability discovered in the golang.org/x/text/language package that affects versions prior to 0.3.8. The vulnerability was discovered by OSS-Fuzz and reported by Adam Korczynski from ADA Logics. It was disclosed on October 11, 2022, and involves the ParseAcceptLanguage function's handling of Accept-Language headers (Golang Announce).

The vulnerability stems from a quadratic time complexity issue in the BCP 47 tag parser's design. When processing Accept-Language headers, the ParseAcceptLanguage function can be forced to consume significant processing time when parsing complex tags. The vulnerability has been assigned a CVSS score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NetApp Security).

When successfully exploited, this vulnerability can lead to a Denial of Service (DoS) condition. Since the parser is exposed to untrusted user input through Accept-Language headers, attackers can leverage this vulnerability to force applications to consume significant computational resources (Go Issue).

The vulnerability can be exploited by crafting specific Accept-Language headers that cause the ParseAcceptLanguage function to perform time-consuming parsing operations. The parser's exposure to untrusted user input makes this vulnerability particularly concerning for public-facing applications (Go Vulnerability).

The vulnerability has been fixed in golang.org/x/text version 0.3.8. Users are advised to upgrade to this version or later to address the security issue (Golang Announce).