Openshift Enterprise source-to-image vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip)

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command. Specific Go Packages...

Rocky Linux 9 : go-toolset and golang (RLSA-2022:5799)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5799 advisory. - Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function cou...

golang.org/x/net/http2/h2c vulnerable to request smuggling attack

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be...

Moderate Photon OS Security Update - PHSA-2022-4.0-0305

Updates of 'go' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2022-0305

Updates of 'go' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2022-3.0-0509

Updates of 'go' packages of Photon OS have been released...

AlmaLinux 9 : toolbox (ALSA-2022:8098)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8098 advisory. - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if...

Important Photon OS Security Update - PHSA-2022-0282

Updates of 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-0541

Updates of 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-4.0-0282

Updates of 'go' packages of Photon OS have been released...

Oracle Linux 8 : grafana (ELSA-2022-7519)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-7519 advisory. - resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse functions - resolve CVE-2022-1705 golang: net/http: improper sanitization of...

Important Photon OS Security Update - PHSA-2022-4.0-0273

Updates of 'go' packages of Photon OS have been released...

golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

GHSA-69CH-W2M2-3VJP golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

MGASA-2022-0356 Updated golang packages fix security vulnerability

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. CVE-2022-27664 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path...

Important Photon OS Security Update - PHSA-2022-3.0-0455

Updates of 'ImageMagick', 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-0242

Updates of 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-4.0-0242

Updates of 'go' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2022-0498

Updates of 'go' packages of Photon OS have been released...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to an issue in OPM and Golang Go packages (CVE-2020-15257, CVE-2021-21334 and CVE-2021-41771)

Summary IBM MQ Operator catalog container image is vulnerable to an issue in OPM package from Red Hat openshift4/ose-operator-registry and IBM MQ Operator, IBM Supplied Queue Manager container images are vulnerable to an issue in the Golang Go packages. CVE-2020-15257, CVE-2021-21334 and...