Google Go 信任管理问题漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. Google Go for macOS 1.18.1 A security vulnerability exists in version 1.18.x prior to 1.18.1, which stems from a possible crash on macOS when certain incorrectly formatted...

CVE-2022-24675

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...

golang: net/http/httputil: panic due to racy read of persistConn after handler panic

A race condition flaw was found in Go. The incoming requests body weren't closed after the handler panic and as a consequence this could lead to ReverseProxy crash. The highest threat from this vulnerability is to Availability...

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...

Security Bulletin: Operations Dashboard is vulnerable to Go CVE-2022-24921

Summary Operations Dashboard is vulnerable to Go CVE-2022-24921 with details below Vulnerability Details CVEID: CVE-2022-24921 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation. By using a specially-crafted deeply nested expression, a remote attacker...

OESA-2022-1606 golang security update

The Go Programming Language. Security Fixes: cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.CVE-2022-23773...

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

The vulnerability of the net/http/httputil component in the Golang programming language allows a attacker to compromise data integrity.

The vulnerability of the net/http/httputil component in the Golang programming language is related to authentication errors. Exploiting this vulnerability allows an attacker to compromise data integrity...

The vulnerability of the Golang programming language’s archive/zip component, which allows a hacker to trigger a service failure.

The vulnerability of the Golang programming language’s archive/zip component is related to the lack of checks for the number of files in the archive. Exploiting this vulnerability allows a malicious actor to trigger a service failure using an altered archive file...

golang: net/http: limit growth of header canonicalization cache

There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader function. An attacker who submits specially crafted requests to applications linked with net/http's http2 functionality could cause excessive resource consumption that could lead to a denial of...

FreeBSD : go -- multiple vulnerabilities (e2af876f-a7c8-11ec-9a2a-002324b2fba8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e2af876f-a7c8-11ec-9a2a-002324b2fba8 advisory. - regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply...

OESA-2022-1585 golang security update

The Go Programming Language. Security Fixes: Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.CVE-2022-23772 Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly...

golang: syscall: don't close fd 0 on ForkExec error

There's a flaw in golang's syscall.ForkExec interface. An attacker who manages to first cause a file descriptor exhaustion for the process, then cause syscall.ForkExec to be called repeatedly, could compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked...

DEBIAN-CVE-2022-24921

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression...

AZL-79112 CVE-2022-24921 affecting package golang 1.25.7-1

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression...

Google Golang 资源管理错误漏洞

Google Go is a development language of Google, Inc. Google Go memory consumption vulnerability, which originates from regexp. The compilation process may deplete stack resources through deeply nested expressions, which can be exploited by attackers to consume system resources...

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

CVE-2022-0664

Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1...

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

...

Git LFS can execute a Git binary from the current directory on Windows

Impact On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-2795...