PT-2022-4659

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.18.6 Go versions 1.19.x prior to 1.19.1 Description The issue is related to the net/http package in Go, where an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error, leading to a denial ...

CVE-2022-30633 Stack exhaustion when unmarshaling certain documents in encoding/xml

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag...

SUSE-SU-2022:2672-1 Security update for go1.18

This update for go1.18 fixes the following issues: Update to go version 1.18.5 bsc1193742: - CVE-2022-32189: encoding/gob, math/big: decoding big.Float and big.Rat can panic bsc1202035. - CVE-2022-1705: net/http: improper sanitization of Transfer-Encoding header bsc1201434 - CVE-2022-32148:...

SUSE-SU-2022:2671-1 Security update for go1.17

This update for go1.17 fixes the following issues: Update to go version 1.17.13 bsc1190649: - CVE-2022-32189: encoding/gob, math/big: decoding big.Float and big.Rat can panic bsc1202035. - CVE-2022-30635: encoding/gob: stack exhaustion in Decoder.Decode bsc1201444. - CVE-2022-30631: compress/gzip...

Improper Certificate Validation

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Improper Certificate Validation. Go Vulnerability Report: A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use.A...

PT-2022-20220 · Go +8 · Go +8

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.17.12 Go versions prior to 1.18.4 Description: The issue is related to uncontrolled recursion in Glob in io/fs, which allows an attacker to cause a panic due to stack exhaustion. This can be achieved by providing a path...

CVE-2022-30591

quic-go through 0.27.0 allows remote attackers to cause a denial of service CPU consumption via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtudiscoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the...

CVE-2022-29526

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...

SUSE-SU-2022:2004-1 Security update for go1.17

This update for go1.17 fixes the following issues: Update to go1.17.11 released 2022-06-01 bsc1190649: - CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers bsc1200134. - CVE-2022-30629: Fixed crypto/tls session tickets lack random ticketageadd bsc1200135. -...

CVE-2022-24675

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...

DEBIAN-CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags...

AZL-8513 CVE-2022-23773 affecting package golang for versions less than 1.17.8-1

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags...

Security update for singularity (moderate)

openSUSE Security Update: Security update for singularity Announcement ID: openSUSE-SU-2021:1525-1 Rating: moderate References: 1193273 Cross-References: CVE-2021-41190 CVSS scores: CVE-2021-41190 NVD : 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP...

OPENSUSE-SU-2021:3834-1 Security update for go1.16

This update for go1.16 fixes the following issues: Security update go1.16.10 released 2021-11-04 bsc1182345. - CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic bsc1192377. - CVE-2021-41772: Fixed panic on Reader.Open bsc1192378...

SUSE-SU-2021:3488-1 Security update for go1.17

This update for go1.17 fixes the following issues: Update to go1.17.2 - CVE-2021-38297: misc/wasm, cmd/link: do not let command line args overwrite global data bsc1191468...

OPENSUSE-SU-2021:3292-1 Security update for go1.16

This update for go1.16 fixes the following issues: - Update to go 1.16.8 - CVE-2021-39293: Fixed a buffer overflow issue in preallocation check that can cause OOM panic. bas...

SUSE-SU-2021:3292-1 Security update for go1.16

This update for go1.16 fixes the following issues: - Update to go 1.16.8 - CVE-2021-39293: Fixed a buffer overflow issue in preallocation check that can cause OOM panic. bas...

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet which (in some situations) allows attackers to bypass access control that is based on IP addresses because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

...

SUSE-SU-2021:2392-1 Security update for go1.16

This update for go1.16 fixes the following issues: go1.16.6 released 2021-07-12, bsc1182345 includes a security fix to the crypto/tls package, as well as bug fixes to the compiler, and the net and net/http packages. Security issue fixed: CVE-2021-34558: Fixed crypto/tls: clients can panic when...

SUSE-SU-2021:2214-1 Security update for go1.15

This update for go1.15 fixes the following issues: Update to 1.15.13. Includes these security fixes - CVE-2021-33195: net: Lookup functions may return invalid host names bsc1187443. - CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion bsc1186622. - CVE-2021-33197:...