South Korean ERP Vendor's Server Hacked to Spread Xctdoor Malware

An unnamed South Korean enterprise resource planning ERP vendor's product update server has been found to be compromised to deliver a Go-based backdoor dubbed Xctdoor. The AhnLab Security Intelligence Center ASEC, which identified the attack in May 2024, did not attribute it to a known threat act...

go-toolset security update

delve 1.21.2-3.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.21.2-3 - Skip an additional test as it's breaking in the CI system. - Modify the name of the patch. - Resolves: RHEL-22820 1.21.2-2 - Fix: Remove architectures from exclude ExcludeArch - Resolves: RHEL-22820 1.21.2-1...

CBL Mariner 2.0 Security Update: terraform (CVE-2024-3817)

The version of terraform installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-3817 advisory. - HashiCorp's go-getter library is vulnerable to argument injection when executing Git to discover remote...

CBL Mariner 2.0 Security Update: telegraf (CVE-2024-28110)

The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28110 advisory. - Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior t...

Oracle Linux 8 : go-toolset (ELSA-2024-4237)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4237 advisory. - Update to Go1.21.11 to address CVE-2024-24789 and CVE-2024-24790 - Rebase to Go1.21.11 that includes fixes for CVE-2024-24789 and CVE-2024-24790...

Oracle Linux 9 : golang (ELSA-2024-4212)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4212 advisory. - Update to Go 1.21.11 that fixes CVE-2024-24789 and CVE-2024-24790 Tenable has extracted the preceding description block directly from the Oracle Linu...

GO Simple Tunnel Security Vulnerability

GO Simple Tunnel is a GO language implementation of a secure tunnel by ginuerzh individual developers. A security vulnerability exists in GO Simple Tunnel version 2.11.5, which stems from an authentication bypass issue in the SSH service that allows an attacker to intercept communication via a...

CBL Mariner 2.0 Security Update: cri-tools / docker-buildx / kubernetes / opa / prometheus (CVE-2023-45142)

The version of cri-tools / docker-buildx / kubernetes / opa / prometheus installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-45142 advisory. - OpenTelemetry-Go Contrib is a collection of third-party...

AlmaLinux 8 : go-toolset (ALSA-2024:4237)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:4237 advisory. golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-24789 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6...

CBL Mariner 2.0 Security Update: containerd / cri-tools / docker-buildx / docker-compose / moby-containerd-cc (CVE-2023-47108)

The version of containerd / cri-tools / docker-buildx / docker-compose / moby-containerd-cc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-47108 advisory. - OpenTelemetry-Go Contrib is a collecti...

AZL-78960 CVE-2024-24791 affecting package golang 1.25.7-1

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail...

DEBIAN-CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

AZL-79036 CVE-2023-24531 affecting package golang 1.26.5-2

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

AZL-43110 CVE-2023-24531 affecting package golang for versions less than 1.21.0-1

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

AZL-43104 CVE-2023-24531 affecting package msft-golang for versions less than 1.21.0-1

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

AZL-52719 CVE-2023-24531 affecting package golang for versions less than 1.21.0-1

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

UBUNTU-CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

CVE-2023-24531 Output of "go env" does not sanitize values in cmd/go

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...