CVE-2022-27536

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...

CVE-2022-27536

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...

CVE-2022-27536

Removed by vendor...

CVE-2022-27536

CVE-2022-27536 affects Go 1.18.x before 1.18.1; Certificate.Verify in crypto/x509 may panic on macOS when presented with certain malformed certificates, causing a remote TLS client panic. Affected: Go 1.18.x before 1.18.1. Remediation: upgrade to Go 1.18.1 or newer (patched version).

CVE-2022-27536

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...

CVE-2022-27536

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...

CVE-2022-27536: Improper Certificate Validation

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...

CVE-2022-27536

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...

PT-2022-18473

Name of the Vulnerable Software and Affected Versions Go versions 1.18.0 through 1.18.0 Description The issue arises when the Certificate.Verify function in crypto/x509 is presented with certain malformed certificates, causing it to panic on macOS. This can be exploited by a remote TLS server to...

SUSE-SU-2022:1167-1 Security update for go1.17

This update for go1.17 fixes the following issues: Update to version 1.17.8 bsc1190649: - CVE-2022-24921: Fixed a potential denial of service via large regular expressions bsc1196732. Non-security fixes: - Fixed an issue with v2 modules go51332. - Fixed an issue when building source in riscv64...

go -- multiple vulnerabilities

The Go project reports: encoding/pem: fix stack overflow in Decode. A large more than 5 MB PEM input can cause a stack overflow in Decode, leading the program to crash. crypto/elliptic: tolerate all oversized scalars in generic P-256. A crafted scalar input longer than 32 bytes can cause...

The vulnerability of the mbedtls_x509_crl_parse_der function in TLS and SSL implementations allows a attacker to cause a service failure.

The vulnerability of the mbedtlsx509crlparseder function in TLS and SSL protocols involves reading data beyond the allowable buffer size. Exploiting this vulnerability allows a remote attacker to cause service failures...

PT-2022-3348

Name of the Vulnerable Software and Affected Versions OpenV2G version 0.9.4 Description A vulnerability has been identified in the OpenV2G EXI parsing feature, which is missing a length check when parsing X509 serial numbers. This allows an attacker to introduce a buffer overflow, leading to memo...

kernel security, bug fix, and enhancement update

4.18.0-348.20.15.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security and bug fix update

3.10.0-1160.59.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.9 - Update oraclekernel-sig-key...

Improper Certificate Validation

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Improper Certificate Validation. Go Vulnerability Report: On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in...

AlmaLinux 8 : openssl (ALSA-2021:4424)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4424 advisory. - Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases where the input length is close to...

Mageia: Security Advisory (MGASA-2017-0321)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-44533

A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...

CVE-2021-44532

It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host...