CVE-2020-9283

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client...

golang: invalid public key causes panic in dsa.Verify

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates...

Google Go Trust Management Issues Vulnerabilities

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google. A vulnerability exists in Google Go for trust management issues. The vulnerability stems from the lack of an effective trust management mechanism in a networked system or product...

CVE-2019-14809

CVE-2019-14809 (Go): The issue arises in net/url parsing in Go before 1.11.13 and 1.12.x before 1.12.8, where malformed hosts in URLs can allow an authorization bypass by crafting a Host field suffix not present in Hostname() or Port(). Example: a javascript:// URL yielding a hostname like google...

CVE-2018-16873

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not ...

EUVD-2018-8665

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces both '' and '' characters. Specifically, it is only vulnerable in GOPATH mode, but not in module mode th...

Go Ethereum Denial of Service Vulnerability

Go Ethereum aka geth is an open source implementation of the Ether protocol written in the Go language. A security vulnerability exists in the cmd/evm/runner.go file in Go Ethereum version 1.8.17. An attacker can exploit the vulnerability with the help of specially crafted bytecode to cause a...

Google Go Command Execution Vulnerability

Google Go is a programming language optimized for programming applications on multiprocessor systems by Google. A security vulnerability exists in Google Go versions prior to 1.8.7, 1.9.x prior to 1.9.4, and 1.10 pre-releases prior to 1.10rc2. A remote attacker could exploit the vulnerability to...

Google Golang Go Certificate Validation Vulnerability

Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. A security vulnerability exists in Google Golang Go versions 1.7.3 and 1.6.3. A remote attacker can exploit this vulnerability to authenticate a connection with the help of...

Google Golang Go Information Disclosure Vulnerability

Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. An information disclosure vulnerability exists in Google Golang Go versions prior to 1.8.4 and 1.9.x versions prior to 1.9.1. An attacker can exploit this vulnerability to conduc...

Google Go is vulnerable

Google Go is a programming language optimized for programming applications on multiprocessor systems by Google. A security vulnerability exists in the curve P-256 implementation in Google Go versions prior to 1.7.6 and 1.8.x versions prior to 1.8.2. An attacker could exploit this vulnerability to...

CVE-2016-3958

CVE-2016-3958: Untrusted search path vulnerability in Go on Windows. A Trojan horse DLL in the current working directory can be loaded via LoadLibrary, enabling local privilege escalation. Affected Go versions: pre-1.5.4 and 1.6.x before 1.6.1. Mitigation from connected sources: upgrade stdlib/sy...