2496 matches found
PT-2022-19706 · Unknown · Kardianos Service Package
Name of the Vulnerable Software and Affected Versions: kardianos service package for Go affected versions not specified Description: The issue is related to the service windows.go file in the kardianos service package for Go, which omits quoting that is sometimes needed for the execution of a...
AZL-78958 CVE-2022-27536 affecting package golang 1.26.7-1
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...
AZL-9527 CVE-2022-24675 affecting package golang for versions less than 1.18.3-1
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
CVE-2022-27536
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...
UBUNTU-CVE-2022-24675
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
Google Go 信任管理问题漏洞
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. Google Go for macOS 1.18.1 A security vulnerability exists in version 1.18.x prior to 1.18.1, which stems from a possible crash on macOS when certain incorrectly formatted...
CVE-2022-24675
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
golang: net/http/httputil: panic due to racy read of persistConn after handler panic
A race condition flaw was found in Go. The incoming requests body weren't closed after the handler panic and as a consequence this could lead to ReverseProxy crash. The highest threat from this vulnerability is to Availability...
golang: crypto/tls: certificate of wrong type is causing TLS client to panic
A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...
Security Bulletin: Operations Dashboard is vulnerable to Go CVE-2022-24921
Summary Operations Dashboard is vulnerable to Go CVE-2022-24921 with details below Vulnerability Details CVEID: CVE-2022-24921 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation. By using a specially-crafted deeply nested expression, a remote attacker...
OESA-2022-1606 golang security update
The Go Programming Language. Security Fixes: cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.CVE-2022-23773...
golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet
A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
Golang net/http/httputil Component Compromise
The vulnerability of the net/http/httputil component in the Golang programming language is related to authentication errors. Exploiting this vulnerability allows an attacker to compromise data integrity...
Golang archive/zip DoS
The vulnerability of the Golang programming language’s archive/zip component is related to the lack of checks for the number of files in the archive. Exploiting this vulnerability allows a malicious actor to trigger a service failure using an altered archive file...
golang: net/http: limit growth of header canonicalization cache
There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader function. An attacker who submits specially crafted requests to applications linked with net/http's http2 functionality could cause excessive resource consumption that could lead to a denial of...
FreeBSD : go -- multiple vulnerabilities (e2af876f-a7c8-11ec-9a2a-002324b2fba8)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e2af876f-a7c8-11ec-9a2a-002324b2fba8 advisory. - regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply...
OESA-2022-1585 golang security update
The Go Programming Language. Security Fixes: Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.CVE-2022-23772 Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly...
golang: syscall: don't close fd 0 on ForkExec error
There's a flaw in golang's syscall.ForkExec interface. An attacker who manages to first cause a file descriptor exhaustion for the process, then cause syscall.ForkExec to be called repeatedly, could compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked...
