2254 matches found
AZL-6448 CVE-2020-29509 affecting package golang for versions less than 1.20.10-1
The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...
AZL-78900 CVE-2020-29509 affecting package golang 1.25.7-1
The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...
AZL-6449 CVE-2020-29511 affecting package golang for versions less than 1.20.10-1
The encoding/xml package in Go all versions does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...
UBUNTU-CVE-2020-29509
The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...
PT-2020-17180 · Go +1 · Gosaml2 +2
Name of the Vulnerable Software and Affected Versions: encoding/xml package in Go all versions Description: The issue allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications. This can cause XML Digital Signature...
golang: malicious symbol names can lead to code execution at build time
An input validation vulnerability was found in Go. From a generated go file from the cgo tool, it is possible to modify symbols within that object file and specify code. This flaw allows an attacker to create a repository that includes malicious pre-built object files that could execute arbitrary...
golang: improper validation of cgo flags can lead to code execution at build time
An input validation vulnerability was found in Go. If cgo is specified in a Go file, it is possible to bypass the validation of arguments to the gcc compiler. This flaw allows an attacker to create a malicious repository that can execute arbitrary code when downloaded and run via go get or go bui...
golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
A flaw was found in the Go encoding/binary package. Certain invalid inputs to the ReadUvarint or the ReadVarint causes those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This flaw possibly leads to processing more input than expected. The...
golang: data race in certain net/http servers including ReverseProxy can lead to DoS
A flaw was found Go's net/http package. Servers using ReverseProxy from net/http in the Go standard library are vulnerable to a data race that results in a denial of service. The highest threat from this vulnerability is to system availability...
golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
A flaw was found in the Go encoding/binary package. Certain invalid inputs to the ReadUvarint or the ReadVarint causes those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This flaw possibly leads to processing more input than expected. The...
CVE-2020-28362
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service...
CVE-2020-28362
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service...
UBUNTU-CVE-2020-28362
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service...
CVE-2020-28362
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service...
CVE-2020-28362
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service...
UBUNTU-CVE-2020-26521
The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...
golang: data race in certain net/http servers including ReverseProxy can lead to DoS
A flaw was found Go's net/http package. Servers using ReverseProxy from net/http in the Go standard library are vulnerable to a data race that results in a denial of service. The highest threat from this vulnerability is to system availability...
golang: data race in certain net/http servers including ReverseProxy can lead to DoS
A flaw was found Go's net/http package. Servers using ReverseProxy from net/http in the Go standard library are vulnerable to a data race that results in a denial of service. The highest threat from this vulnerability is to system availability...
Security Bulletin: API Connect is vulnerable to denial of service (CVE-2020-16845)
Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-16845 DESCRIPTION: Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. By sending a specially-crafted input, a...
ALERT! Hackers targeting IoT devices with a new P2P botnet malware
Cybersecurity researchers have taken the wraps off a new botnet hijacking Internet-connected smart devices in the wild to perform nefarious tasks, mostly DDoS attacks, and illicit cryptocurrency coin mining. Discovered by Qihoo 360's Netlab security team, the HEH Botnet — written in Go language a...