40 matches found
Google Go security vulnerabilities
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google. A code execution vulnerability exists in Google Go due to unsafe handling of compiler flags in CgoPkgConfig. An attacker can exploit the vulnerability to execute arbitrary code on...
EUVD-2022-1028
Malicious code in bioql PyPI...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the SplitRTR function in the rtr.go file, which allows access to data without checking the input length. An attacker can cause a denial of service by sending specially crafted input. Remediation Upgrade...
go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion
A flaw was found in the go/parser package of the Golang standard library. Calling any Parse functions on Go source code containing deeply nested literals can cause a panic due to stack exhaustion...
CVE-2023-37896 Nuclei Path Traversal vulnerability
Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code SDK running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payload loading in sandbox mode. Ther...
CVE-2023-36456
authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy a...
CVE-2023-36456 Authentik lacks Proxy IP headers validation
authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy a...
[SECURITY] Fedora 36 Update: nex-20210330-4.fc36
Nex is a lexer similar to Lex/Flex that: 1 generates Go code instead of C code, 2 integrates with Go's Yacc instead of YACC/Bison, 3 supports UTF-8, and 4 supports nested structural regular expressions...
[SECURITY] Fedora 36 Update: golang-github-shurcool-vfsgen-0-0.12.20210113git0d455de.fc36
Package Vfsgen takes an http.FileSystem likely at go generate time and generates Go code that statically implements the provided http.FileSystem...
[SECURITY] Fedora 36 Update: go-bindata-3.0.7-23.gita0ff256.fc36
A small utility which generates Go code from any file This tool converts any file into managable Go source code. Useful for embedding binary data into a go program. The file data is optionally gzip compressed before being converted to a raw byte slice...
[SECURITY] Fedora 35 Update: go-bindata-3.0.7-22.gita0ff256.fc35
A small utility which generates Go code from any file This tool converts any file into managable Go source code. Useful for embedding binary data into a go program. The file data is optionally gzip compressed before being converted to a raw byte slice...
[SECURITY] Fedora 35 Update: nex-20210330-2.fc35
Nex is a lexer similar to Lex/Flex that: 1 generates Go code instead of C code, 2 integrates with Go's Yacc instead of YACC/Bison, 3 supports UTF-8, and 4 supports nested structural regular expressions...
[SECURITY] Fedora 36 Update: golang-github-shurcool-vfsgen-0-0.11.20210113git0d455de.fc36
Package Vfsgen takes an http.FileSystem likely at go generate time and generates Go code that statically implements the provided http.FileSystem...
SQL Injection
Description A SQL Injection in rqlite store Proof of Concept use example code go package main import "io" "log" "net/http" "github.com/alexedwards/scs/rqlitestore" "github.com/alexedwards/scs/v2" "github.com/rqlite/gorqlite" var sessionManager scs.SessionManager func main // Establish connection ...
GHSA-CMGW-8VPC-RC59 Segfault on strings tensors with mistmatched dimensions, due to Go code
Impact Under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TFTStringDealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method...
Design/Logic Flaw
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TFTStringDealloc is called during garbage collection within a finalizer function. However, tensor...
CVE-2020-26521
The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...
CVE-2020-26521
The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...
Asterisk 17.6.0 / 17.5.1 Denial Of Service
Asterisk crash due to INVITE flood over TCP - Fixed versions: 13.37.1, 16.14.1, 17.8.1, 18.0.1 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2020-02-asterisk-tcp-invite-crash - Asterisk Security Advisory:...
thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0...