CVE-2024-35232 github.com/huandu/facebook may expose access_token in error message

github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...

AZL-40480 CVE-2024-24788 affecting package golang for versions less than 1.22.3-1

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop...

CVE-2024-28232

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that...

CVE-2024-28232

The CVE-2024-28232 entry concerns a username enumeration flaw in CasaOS-UserService (CasaOS Login page). The issue arises because the login responses reveal whether a username exists, enabling enumeration. It was patched in CasaOS v0.4.8, though that version had not yet been uploaded to Go's pack...

CVE-2024-28232 Username Enumeration in CasaOS via bypass of CVE-2024-24766

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that...

CVE-2024-28232 Username Enumeration in CasaOS via bypass of CVE-2024-24766

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that...

Improper Preservation of Permissions in etcd

Vulnerability type Access Controls Detail etcd creates certain directory paths etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...

Important Photon OS Security Update - PHSA-2023-4.0-0531

Updates of 'go', 'vim' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-5.0-91-0176

Updates of 'go', 'vim' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-5.0-0176

Updates of 'vim', 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-3.0-0702

Updates of 'vim', 'go' packages of Photon OS have been released...

GHSA-J3RQ-4XJW-XG63 Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks

Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. Patches The issue has been patched in v1.4.0 Workarounds Directly using the...

CVE-2023-49292 Possible private key restoration in go package github.com/ecies/go

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate, Decapsulate and ECDH could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade...

PT-2023-36290 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...

GHSA-3F2Q-6294-FMQ5 Inefficient Regular Expression Complexity in git-urls

git-urls version 1.0.1 is vulnerable to ReDOS Regular Expression Denial of Service in Go package...

Inefficient Regular Expression Complexity in git-urls

git-urls version 1.0.1 is vulnerable to ReDOS Regular Expression Denial of Service in Go package...

CVE-2023-46402

Git-URLs 1.0.0 is vulnerable to a Regular Expression Denial of Service (ReDOS) in urls.go. Connected Fedora advisories confirm a bugfix mitigating CVE-2023-46402, e.g., updating to golang-github-chainguard-dev-git-urls 1.0.2 for Fedora 41. No additional exploit details are provided in the connect...

OPENSUSE-SU-2023:0360-1 Security update for go1.21

This update introduces go1.21, including fixes for the following issues: - go1.21.3 released 2023-10-10 includes a security fix to the net/http package. Refs boo1212475 go1.21 release tracking CVE-2023-39325 CVE-2023-44487 go63427 go63417 boo1216109 security: fix CVE-2023-39325 CVE-2023-44487...

Rocky Linux 8 : go-toolset:rhel8 (RLSA-2021:1746)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1746 advisory. - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb duri...

PT-2023-36285 · Unknown · Cni-Plugins

Name of the Vulnerable Software and Affected Versions: cni-plugins affected versions not specified Description: The issue is related to a security release in the go 1.21 package, which is used to rebuild the cni-plugins package. Recommendations: At the moment, there is no information about a newe...