PT-2023-36247 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.20 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...

CVE-2023-29409

A denial of service vulnerability was found in the Golang Go package caused by an uncontrolled resource consumption flaw. By persuading a victim to use a specially crafted certificate with large RSA keys, a remote attacker can cause a client/server to expend significant CPU time verifying...

PT-2023-36201 · Go +1 · Go +1

Name of the Vulnerable Software and Affected Versions: kubernetes version 1.24 Description: The issue is related to a security release in the go 1.20 package, which is used by kubernetes. The package has been rebuilt with the go 1.20 security release to address the issue. Recommendations: For...

PT-2023-36204 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: cosign affected versions not specified Description: The issue is related to a security release in the go 1.20 package. The cosign package has been rebuilt with this security release to address the issue. No information is provided about the...

GHSA-MV7X-27PC-8C96 Go package pydio/cells vulnerable to authorization bypass

A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. Upgrading to version 4.2.1 is able to address this issue. I...

PT-2023-36181 · Go +1 · Go +1

Name of the Vulnerable Software and Affected Versions: kubernetes1.18 version 1.18 Description: The issue is related to a security release in the go 1.19 package, which is used by kubernetes1.18. The package has been rebuilt with the go 1.19 security release to address the issue. Recommendations:...

Security Bulletin: IBM CICS TX Standard is vulnerable to a denial of service, caused by improper logic in the Yaml Go package decode.go function.

Summary IBM CICS TX Standard is vulnerable to a denial of service, caused by improper logic in the Yaml Go package decode.go function. The fix removes this vulnerability from IBM CICS TX Standard. Vulnerability Details IBM X-Force ID: 221571 DESCRIPTION: Yaml Go package is vulnerable to a denial ...

Security Bulletin: IBM CICS TX Advanced is vulnerable to a denial of service, caused by improper logic in the Yaml Go package decode.go function.

Summary IBM CICS TX Advanced is vulnerable to a denial of service, caused by improper logic in the Yaml Go package decode.go function. The fix removes this vulnerability from IBM CICS TX Advanced. Vulnerability Details IBM X-Force ID: 221571 DESCRIPTION: Yaml Go package is vulnerable to a denial ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the themes.NoPagefilename, theme function due to improper user input sanitization. Exploiting this vulnerability is possible when a file/resource is not found. PoC bash go install...

YAML Go package vulnerable to denial of service

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector...

nosurf 输入验证错误漏洞

nosurf is an HTTP package for Go by Justinas Stankevičius, a personal developer. It helps you prevent cross-site request forgery attacks. A security vulnerability exists in nosurf that stems from incorrect validation of user input...

noise 安全漏洞

noise is a Flynn open source Go package that implements the noise protocol framework. A security vulnerability exists in noise, which stems from a weakened cryptographic security of the Noise Protocol implementation after encrypting 2^64 messages, and a potential denial-of-service attack...

Important Photon OS Security Update - PHSA-2022-0519

Updates of 'go' packages of Photon OS have been released...

GO-2022-0190 Directory traversal via "go get" command in cmd/go

The "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly brace both '' and '' characters. Specifically, it is only vulnerable in GOPATH mode, but not in module mode the distinction is documented at...

[SECURITY] Fedora 36 Update: golang-github-nicksnyder-i18n-2-2.1.2-6.fc36

go-i18n is a Go package and a command that helps you translate Go programs in to multiple languages. - Supports pluralized strings for all 200+ languages in the Unicode Common Locale Data Repository CLDR. - Code and tests are automatically generated from CLDR data. - Supports strings with named...

[SECURITY] Fedora 36 Update: golang-github-a8m-envsubst-1.3.0-3.fc36

Go package for substituting environment variables...

[SECURITY] Fedora 36 Update: glide-0.13.2-11.fc36

Glide is a tool for managing the vendor directory within a Go package. This feature, first introduced in Go 1.5, allows each package to have a vendor directory containing dependent packages for the project. These vendor packages can be installed by a tool e.g. glide, similar to go get or they can...

[SECURITY] Fedora 35 Update: golang-github-zyedidia-highlight-0-0.6.20200218git291680f.fc35

A Go package for syntax highlighting...

[SECURITY] Fedora 35 Update: golang-github-rickb777-date-1.15.3-4.fc35

A Go package for working with dates...

[SECURITY] Fedora 35 Update: golang-github-nicksnyder-i18n-2-2.1.2-5.fc35

go-i18n is a Go package and a command that helps you translate Go programs in to multiple languages. - Supports pluralized strings for all 200+ languages in the Unicode Common Locale Data Repository CLDR. - Code and tests are automatically generated from CLDR data. - Supports strings with named...