Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-31054

CVE-2022-31054: Uses of deprecated API can be used to cause DoS in user-facing endpoints

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-31054
GHSA ID
GHSA-5q86-62xr-3r57
EPSS Score
0.66421%
CWE
CWE-400
Published
6/17/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/argoproj/argo-eventsgo< 1.7.11.7.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from using deprecated ioutil.ReadAll() which reads entire request bodies into memory. The commit diff shows replacements of ioutil.ReadAll() with io.ReadAll combined with http.MaxBytesReader in multiple event source handlers. The affected components listed in the advisory (AWS SNS, Bitbucket, Gitlab, etc.) correspond to these patched files. Each identified function was directly modified in the security patch, indicating they were vulnerable endpoints allowing DoS via large payloads.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t S*v*r*l `**n*l*Rout*` *n*points m*k* us* o* t** **pr***t** `ioutil.R****ll()`. `ioutil.R****ll()` r***s *ll t** **t* into m*mory. *s su**, *n *tt**k*r w*o s*n*s * l*r** r*qu*st to t** *r*o *v*nts s*rv*r will ** **l* to *r*s* it *n* **us* *

Reasoning

T** vuln*r**ility st*ms *rom usin* **pr***t** `ioutil.R****ll()` w*i** r***s *ntir* r*qu*st *o*i*s into m*mory. T** *ommit *i** s*ows r*pl***m*nts o* `ioutil.R****ll()` wit* `io.R****ll` *om*in** wit* `*ttp.M*x*yt*sR****r` in multipl* *v*nt sour** **