[SECURITY] Fedora 35 Update: golang-github-nicksnyder-i18n-2-2.1.2-5.fc35

go-i18n is a Go package and a command that helps you translate Go programs in to multiple languages. - Supports pluralized strings for all 200+ languages in the Unicode Common Locale Data Repository CLDR. - Code and tests are automatically generated from CLDR data. - Supports strings with named...

[SECURITY] Fedora 35 Update: golang-github-kyokomi-emoji-2.2.8-5.fc35

Emoji terminal output for Go...

[SECURITY] Fedora 35 Update: glide-0.13.2-10.fc35

Glide is a tool for managing the vendor directory within a Go package. This feature, first introduced in Go 1.5, allows each package to have a vendor directory containing dependent packages for the project. These vendor packages can be installed by a tool e.g. glide, similar to go get or they can...

Kubeaudit - Tool To Audit Your Kubernetes Clusters Against Common Security Controls

kubeaudit is a command line tool and a Go package to audit Kubernetes clusters for various different security concerns, such as: run as non-root use a read-only root filesystem drop scary capabilities, don't add new ones don't run privileged and more! tldr.kubeaudit makes sure you deploy secure...

[SECURITY] Fedora 36 Update: golang-github-zyedidia-highlight-0-0.6.20200218git291680f.fc36

A Go package for syntax highlighting...

[SECURITY] Fedora 36 Update: golang-github-nicksnyder-i18n-2-2.1.2-5.fc36

go-i18n is a Go package and a command that helps you translate Go programs in to multiple languages. - Supports pluralized strings for all 200+ languages in the Unicode Common Locale Data Repository CLDR. - Code and tests are automatically generated from CLDR data. - Supports strings with named...

[SECURITY] Fedora 36 Update: glide-0.13.2-10.fc36

Glide is a tool for managing the vendor directory within a Go package. This feature, first introduced in Go 1.5, allows each package to have a vendor directory containing dependent packages for the project. These vendor packages can be installed by a tool e.g. glide, similar to go get or they can...

Denial of Service (DoS)

Overview github.com/containrrr/shoutrrr/pkg/util is a notification library for gophers. Affected versions of this package are vulnerable to Denial of Service DoS via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters...

flynn/noise has improper nonce handling yielding potential state DoS

The Go package github.com/flynn/noise, a Noise Protocol implementation, has two bugs in nonce handling in versions prior to v1.0.0. Issue 1: Potential nonce overflow If 264 18.4 quintillion or more messages are encrypted with Encrypt after handshaking, the nonce counter will wrap around, causing...

CVE-2022-23773

A flaw was found in the go package of the cmd library in golang. The go command could be tricked into accepting a branch, which resembles a version tag. This issue could allow a remote unauthenticated attacker to bypass security restrictions and introduce invalid or incorrect tags, reducing the...

Cross-site Scripting (XSS)

Overview std/net/http/fcgi is a Go standard library package std/net/http/fcgi Affected versions of this package are vulnerable to Cross-site Scripting XSS. Go Vulnerability Report:When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which...

GHSA-M7VP-HQWV-7M5X Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints

Impact The net/http Go package has a reported vulnerability tracked under CVE-2021-44716 which allows attacker controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints. gRPC endpoints are not vulnerable as they rely on their own HTTP/2 implementation instead of the net/htt...

github.com/tidwall/gjson Vulnerable to REDoS attack

GJSON is a Go package that provides a fast and simple way to get values from a json document. GJSON before 1.9.3 allows a ReDoS regular expression denial of service attack...

Photon OS 3.0: Go PHSA-2021-3.0-0276

An update of the go package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0276. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc';...

Photon OS 4.0: Go PHSA-2021-4.0-0046

An update of the go package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0046. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

[ASA-202106-42] go: multiple issues

Arch Linux Security Advisory ASA-202106-42 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198 Package : go Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2006 Summary...

Photon OS 3.0: Go PHSA-2021-3.0-0248

An update of the go package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0248. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

GHSA-25XJ-89G5-FM6H Information Disclosure in HashiCorp Vault

HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File. The vulnerability is affecting github.com/hashicorp/vault/command Go package...

GHSA-75PC-QVWC-JF3G Improper Input Validation in HashiCorp Vault

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control...

Improper Input Validation in HashiCorp Vault

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control...