CVE-2022-32189: 
Grafana vulnerability analysis and mitigation

CVE-2022-32189 is a vulnerability discovered in Go's math/big package that affects versions before 1.17.13 and 1.18.5. The vulnerability involves a panic condition that can occur in Float.GobDecode and Rat.GobDecode functions when processing too-short encoded messages (NVD, MITRE).

The vulnerability occurs when Float.GobDecode and Rat.GobDecode functions in the math/big package attempt to process encoded messages that are too short, leading to an index out of range panic. The issue has been assigned a CVSS 3.1 base score of 7.5 (High), with attack vector being Network, attack complexity Low, and requiring no privileges or user interaction (Ubuntu).

The vulnerability can potentially lead to a denial of service condition when processing malformed input. When exploited, it causes the application to panic, affecting the availability of the service (Go Issue).

The vulnerability has been fixed in Go versions 1.17.13 and 1.18.5. The fix involves adding proper buffer length checks before indexing slices in Float.GobDecode and Rat.GobDecode functions. Users are advised to upgrade to these patched versions or later (Go Announce).