RockyLinux 8 : container-tools:rhel8 (RLSA-2024:10289)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10289 advisory. golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents CVE-2021-33198 podman: podman machine...

Non-linear parsing of case-insensitive content in golang.org/x/net/html

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-45338

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-45338

CVE-2024-45338 describes a denial-of-service caused by input crafted for parser functions that parses non-linearly with input length. Connected documents specify concrete affected packages and versions: podman < 5.6.1-2; buildah < 1.41.4-2; cni < 1.0.1-20; dasel < 2.8.1-2; packer

CVE-2024-45338 Non-linear parsing of case-insensitive content in golang.org/x/net/html

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-45338 Non-linear parsing of case-insensitive content in golang.org/x/net/html

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

PT-2024-10470

Name of the Vulnerable Software and Affected Versions Golang versions prior to the fixed version Description The issue is related to uncontrolled resource consumption in the Golang programming language. An attacker can craft an input to the Parse functions that would be processed non-linearly wit...

Moderate: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

[SECURITY] Fedora 40 Update: golang-x-crypto-0.31.0-2.fc40

Go supplementary cryptography libraries...

[SECURITY] Fedora 41 Update: golang-x-crypto-0.31.0-2.fc41

Go supplementary cryptography libraries...

Fedora 40 : golang-x-crypto (2024-8f83d0ed92)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-8f83d0ed92 advisory. Fix CVE-2024-45337 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 41 : golang-x-crypto (2024-c33c95804e)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-c33c95804e advisory. Fix CVE-2024-45337 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora: Security Advisory (FEDORA-2024-8f83d0ed92)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GO-2024-3330 Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy in github.com/ryanbekhen/nanoproxy

Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy in github.com/ryanbekhen/nanoproxy...

GO-2022-0635 In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

CVE-2024-45337

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2024-2936)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2024-2981)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2024-2951)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2024-2967)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...