Fedora: Security Advisory (FEDORA-2023-e57f5a2301)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for golang (FEDORA-2023-ace2655259)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: golang-1.20.12-1.fc38

The Go Programming Language...

AZL-32100 CVE-2023-45287 affecting package golang for versions less than 1.20.0-1

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...

Fedora: Security Advisory for golang (FEDORA-2023-7e185b8c12)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

The vulnerability of the Go programming language-based http2 package, which allows a hacker to trigger a service failure

The vulnerability of the Go programming language’s http2 package is related to an uncontrolled resource consumption by the server due to the incorrect setting of the Server.MaxConcurrentStreams parameter when processing request streams. Exploiting this vulnerability can allow a remote attacker to...

golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

PT-2023-36265 · Skopeo · Skopeo

Name of the Vulnerable Software and Affected Versions: skopeo affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.21. The skopeo package has been rebuilt with this security release to address the issue. There is no...

[SECURITY] Fedora 37 Update: golang-1.19.13-1.fc37

The Go Programming Language...

The vulnerability in the golang.org/x/crypto/ssh library for the Go programming language allows a attacker to cause SSH servers to fail.

The vulnerability of the golang.org/x/crypto/ssh library in the Go programming language is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause SSH servers to fail...

PT-2023-36259 · Go +1 · Go +1

Name of the Vulnerable Software and Affected Versions: rekor affected versions not specified Description: The issue is related to a security release in the Go programming language, specifically version 1.21. The rekor package has been rebuilt with this security release to address the issue. There...

PT-2023-36261 · Skopeo · Skopeo

Name of the Vulnerable Software and Affected Versions: skopeo affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.21. The skopeo package has been rebuilt with this security release to address the issue. There is no...

PT-2023-36254 · Google +1 · Go +1

Name of the Vulnerable Software and Affected Versions: amazon-ecs-init affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.21. The update of amazon-ecs-init is intended to address this issue by rebuilding the package wi...

PT-2023-9455 · Go +7 · Go +7

Name of the Vulnerable Software and Affected Versions: Go affected versions not specified Description: The issue is related to the processing of incomplete post-handshake messages for QUIC connections, which can cause a panic. Additionally, there is a vulnerability in the HandleData function of t...

OESA-2023-1501 golang security update

The Go Programming Language. Security Fixes: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host o...

[SECURITY] Fedora 37 Update: golang-1.19.12-1.fc37

The Go Programming Language...

[SECURITY] Fedora 38 Update: golang-1.20.7-1.fc38

The Go Programming Language...

PT-2023-36216 · Google +1 · Go +1

Name of the Vulnerable Software and Affected Versions: amazon-ecs-init affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.20. The update of amazon-ecs-init is intended to address this issue by rebuilding the package wi...

PT-2023-36212 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.20. The terraform-provider-helm package has been rebuilt to incorporate this security...