Astra Linux – Vulnerability in Golang-1.23

The HTTP client discards sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header, which is redirected to b.com/, will not send that header to b.com. However, if the client receives a subsequent same-domain redirect, the...

Astra Linux – Vulnerability in Golang-1.19

The ParseAddressList function improperly handles comments text within parentheses within display names. Since this contradicts conforming address parsers, it can lead to different trust decisions being made by programs that use different parsers...

Astra Linux – Vulnerability in Golang-1.19

Extremely large RSA keys in certificate chains can cause clients and servers to spend significant CPU time verifying signatures. With this fix, the size of RSA keys transmitted during handshake operations is limited to 8192 bits or less. Based on a survey of publicly trusted RSA keys, there are...

Astra Linux – Vulnerability in golang-go.crypto

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server under certain circumstances involving AddHostKey...

Astra Linux - Vulnerability in Golang-1.19

The handling of certain types of invalid zip files by the archive/zip package differs from the behavior of most zip implementations. This discrepancy could be exploited to create a zip file with contents that vary depending on the implementation used to read the file. The archive/zip package now...

Astra Linux – Vulnerability in Golang-1.19

Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Moreover, the error string is created through repeated string concatenation, resulting in quadratic runtime. Therefore, a certificate provided by a malicious actor can...

Astra Linux – Vulnerability in golang-golang-x-text

In golang.org/x/text, the text/language field before version 0.3.7 can cause a panic due to an out-of-bounds read during BCP 47 language tag parsing. Index calculations are also handled incorrectly. If untrusted user input is parsed, this could be exploited as a vector for a denial-of-service...

Astra Linux – Vulnerability in Golang-1.15

In Go versions before 1.14.14 and 1.15.x, as well as before 1.15.7, the crypto/elliptic/p224.go file may generate incorrect outputs due to a underflow of the lowest limb during the final complete reduction of the P-224 field...

Astra Linux – Vulnerability in Golang-1.19

The html/template package does not follow the correct rules for handling occurrences of "", "" within JS literals in contexts. This may cause the template parser to incorrectly consider script contexts as being terminated early, resulting in actions being properly escaped incorrectly. This could ...

Astra Linux – Vulnerability in Golang-1.19

A malicious HTTP/2 client that quickly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is limited by the http2.Server.MaxConcurrentStreams setting, resetting an ongoing request allows the attacker to create a new...

Astra Linux – Vulnerability in Golang-1.19

The html/template package does not properly handle HTML-like “” comment tokens, nor hashbang “!” comment tokens, in contexts. This may cause the template parser to incorrectly interpret the contents of contexts, resulting in actions being incorrectly escaped. This could be exploited to carry out ...

Astra Linux – Vulnerability in Golang-1.19, Golang-1.23

Canceling a query for example, by canceling the context passed to one of the query methods during a call to the Scan method of the returned Rows can lead to unexpected results if other queries are being executed in parallel. This can cause a race condition, which may overwrite the expected result...

Astra Linux - Vulnerability in Golang-1.19

The various “Is” methods IsPrivate, IsLoopback, etc. did not work as expected for IPv4-mapped IPv6 addresses. They returned false for addresses that would return true in their traditional IPv4 form...

Astra Linux - Vulnerability in Golang-1.19

The net/http HTTP/1.1 client mishandled the situation where a server responds to a request with an “Expect: 100-continue” header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, causing the next request sent on that connection to...

Astra Linux – Vulnerability found in Golang versions 1.15, 1.19, and 1.23

The net/http package improperly accepts a bare LF as a line terminator in chunked data with fixed-sized chunks. This can allow for request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...

Astra Linux – Vulnerability in Golang-1.19

The go command may execute arbitrary code during compilation when using cgo. This can occur when running “go get” on a malicious module, or when running any other command that compiles unauthorized code. This issue can be triggered by linker flags, specified via the cgo LDFLAGS directive. Flags...

Astra Linux – Vulnerability in Golang-1.19

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate significantly more memory than is...

Astra Linux – Vulnerability in Golang-1.19

A denial of service is possible due to excessive resource consumption in the net/http and mime/multipart libraries. Parsing multipart forms using mime/multipart.Reader.ReadForm can consume a largely unlimited amount of memory and disk space. This issue also affects form parsing in the net/http...

Astra Linux – Vulnerability in Golang-1.15

In versions of Go prior to 1.15.13 and 1.16.x prior to 1.16.5, a crafted file count present in the archive’s header can lead to a panic in NewReader or OpenReader...

Astra Linux – Vulnerability in Golang-1.15

Versions of Go before 1.14.14 and 1.15.x before 1.15.7 on Windows are vulnerable to Command Injection and remote code execution when using the “go get” command to fetch modules that utilize cgo for example, cgo can execute a GCC program from an untrusted source...