HTTP Request Smuggling

Overview std/net/http/httputil is a Go standard library package std/net/http/httputil Affected versions of this package are vulnerable to HTTP Request Smuggling. Go Vulnerability Report:Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including...

DEBIAN-CVE-2022-27664

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error...

Fedora: Security Advisory for golang-github-cpu-goacmedns (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-j-keck-arping-1.0.2-4.fc36

Arping is a native Go library to ping a host per arp datagram, or query a host mac address...

[SECURITY] Fedora 36 Update: golang-github-google-containerregistry-0.5.1-6.fc36

Go library and CLIs for working with container registries...

[SECURITY] Fedora 36 Update: golang-github-cpu-goacmedns-0.1.1-6.fc36

A Go library to handle acme-dns client communication and persistent account storage...

[SECURITY] Fedora 35 Update: golang-github-j-keck-arping-1.0.1-4.fc35

Arping is a native Go library to ping a host per arp datagram, or query a host mac address...

[SECURITY] Fedora 35 Update: golang-github-cpu-goacmedns-0.1.1-5.fc35

A Go library to handle acme-dns client communication and persistent account storage...

[SECURITY] Fedora 35 Update: age-1.0.0-5.fc35

A simple, modern and secure encryption tool and Go library with small explicit keys, no config options, and UNIX-style composability...

Fedora: Security Advisory for golang-github-j-keck-arping (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Insertion of Sensitive Information into Log File

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

UBUNTU-CVE-2022-29190

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...

[SECURITY] Fedora 34 Update: golang-github-google-containerregistry-0.5.1-4.fc34

Go library and CLIs for working with container registries...

UBUNTU-CVE-2021-39293

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header falsely designating that many files are present can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196...

AZL-79102 CVE-2021-41771 affecting package golang 1.25.7-1

ImportedSymbols in debug/macho for Open or OpenFat in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation...

Denial of Service (DoS)

Overview github.com/pires/go-proxyproto is a Go library implementation of the PROXY protocol, versions 1 and 2. Affected versions of this package are vulnerable to Denial of Service DoS via creating connections without the proxy protocol header. Details Denial of Service DoS describes a family of...

Denial of Service (DoS)

Overview github.com/pires/go-proxyproto is a Go library implementation of the PROXY protocol, versions 1 and 2. Affected versions of this package are vulnerable to Denial of Service DoS via the parseVersion1 function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It wi...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

proglottis/gpgme: Use-after-free in GPGME bindings during container image pull

A use-after-free vulnerability was found in the Go GPGME wrapper library, github.com/proglottis/gpgme. An attacker could use this flaw to crash or cause potential code execution in Go applications that use this library, under certain conditions, during GPG signature verification...

AZL-44877 CVE-2020-14040 affecting package buildah for versions less than 1.41.4-2

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...