opentelemetry-collector security update

An update is available for opentelemetry-collector. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Collector with the supported components for a Rocky Enterpris...

go-toolset:rhel8 security update

An update is available for module.go-toolset, golang, module.delve, go-toolset, module.golang, delve. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset...

RLSA-2025:3210 Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-22869 For more details about the security issues, including the...

K000152788: Golang net/http vulnerability CVE-2025-22871

Security Advisory Description The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...

Security update for kubernetes1.18

This update of kubernetes1.18 fixes the following issues: This update was retracted due to non working kubectl. CVE-2025-22872: Fixed golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction bsc1241865 rebuild the package with the...

K000152727: Golang vulnerabilities CVE-2023-34231, CVE-2024-34155, CVE-2024-34156, and CVE-2024-34158

Security Advisory Description CVE-2023-34231 gosnowflake is the Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on SSO browser URL authentication. In order to exploit the potential for command injection, an...

K000152723: Golang crypto/tls vulnerabilities CVE-2023-39321 and CVE-2023-39322

Security Advisory Description CVE-2023-39321 Processing an incomplete post-handshake message for a QUIC connection can cause a panic. CVE-2023-39322 QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection...

golang-jwt: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt

A flaw was found in the golang-jwt package. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.55 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.55 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

[SECURITY] Fedora 41 Update: golang-1.23.11-1.fc41

The Go Programming Language...

K000152677: Golang net/http vulnerabilities CVE-2023-39326 and CVE-2024-24791

Security Advisory Description CVE-2023-39326 A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to...

Fedora 41 : golang (2025-ef6e0fa117)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ef6e0fa117 advisory. go1.23.11 released 2025-07-08 includes security fixes to the go command, as well as bug fixes to the compiler, the linker, and the runtime. See the issue...

Fedora: Security Advisory (FEDORA-2025-ef6e0fa117)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

K000152676: Golang net vulnerabilities CVE-2023-45290 and CVE-2024-24784

Security Advisory Description CVE-2023-45290 When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the memory consumed while...

K000152675: Golang crypto vulnerabilities CVE-2024-24783 and CVE-2025-22866

Security Advisory Description CVE-2024-24783 Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or...

K000152671: Golang html/template vulnerabilities CVE-2023-39318,CVE-2023-39319, and CVE-2024-24785

Security Advisory Description CVE-2023-39318 The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped...

K000152658: Golang vulnerability CVE-2024-45341

Security Advisory Description A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make...

K000152659: Golang vulnerabilities CVE-2024-45336, CVE-2024-45337, CVE-2024-45338, and CVE-2024-45339

Security Advisory Description CVE-2024-45336 The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a . com/ containing an Authorization header which is redirected to b . com/ will not send that header to b . com. In the event that the client...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2025-1820)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate...