CVE-2024-47534

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-47534

CVE-2024-47534 affects the go-tuf Go TUF client. The root cause is incorrect delegation tracing: when targets delegate to A and B, and B delegates to C, the client may traverse B→C→A instead of A→B→C, due to the way GetRolesForTarget maps are handled in metadata.go. This can cause the client to t...

CVE-2024-47534 Incorrect delegation lookups can make go-tuf download the wrong artifact

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-47534 Incorrect delegation lookups can make go-tuf download the wrong artifact

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

golang: archive/zip: Incorrect handling of certain ZIP files

A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next...

Google Go 输入验证错误漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. An input validation error vulnerability exists in Google Go that stems from the system not properly validating input, which allows a user to pass arbitrary parameters to the...

go-tuf 竞争条件问题漏洞

go-tuf is an open source framework from The Update Framework for protecting software update systems. A competitive condition issue vulnerability exists in go-tuf that stems from inconsistent tracking of delegates...

Google Go 后置链接漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. Google Go suffers from a back-linking vulnerability that stems from improper authentication, where the container runtime may incorrectly handle certain file paths, allowing a...

PT-2024-32647 · Go-Tuf +1 · Go-Tuf +1

Name of the Vulnerable Software and Affected Versions: go-tuf versions prior to 2.0.1 Description: The go-tuf client inconsistently traces the delegations, which can result in downloading the wrong artifact. For example, if targets delegate to "A" and "B", and "B" delegates to "C", the client...

CVE-2024-9355

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

RHSA-2024:1041 Red Hat Security Advisory: go-toolset-1.19-golang security update

Bulletin has no description...

RHSA-2023:3323 Red Hat Security Advisory: go-toolset-1.19 and go-toolset-1.19-golang security update

Bulletin has no description...

RHSA-2023:3318 Red Hat Security Advisory: go-toolset and golang security update

Bulletin has no description...

RLSA-2024:6913 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: net/http: Denial of service due to improper 100-continue handling in net/http CVE-2024-24791 go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion...

RHSA-2023:0445 Red Hat Security Advisory: go-toolset-1.18 security update

Bulletin has no description...

RHSA-2023:0328 Red Hat Security Advisory: go-toolset and golang security and bug fix update

Bulletin has no description...

go-toolset:rhel8 security update

An update is available for module.go-toolset, go-toolset, delve, golang, module.golang, module.delve. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset...

RLSA-2024:6908 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/http: Denial of service due to improper 100-continue handling in net/http CVE-2024-24791 go/parser: golang: Calling any of the Parse functions containing deeply nested...