Fedora: Security Advisory (FEDORA-2023-822aab0a5a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: golang-1.21.3-1.fc39

The Go Programming Language...

[SECURITY] Fedora 39 Update: golang-github-protobuf-1.5.3-3.fc39

Go support for Google's protocol buffers...

[SECURITY] Fedora 39 Update: golang-github-nats-io-streaming-server-0.25.5-1.fc39

NATS Streaming is an extremely performant, lightweight reliable streaming platform built on NATS...

[SECURITY] Fedora 39 Update: golang-github-nats-io-nkeys-0.4.5-2.fc39

A public-key signature system based on Ed25519 for the NATS ecosystem...

[SECURITY] Fedora 39 Update: golang-github-nats-io-1.30.1-1.fc39

Golang client for NATS, the cloud native messaging system...

[SECURITY] Fedora 39 Update: golang-github-envoyproxy-control-plane-0.11.1-1.fc39

Go implementation of data-plane-api...

[SECURITY] Fedora 39 Update: golang-google-protobuf-1.31.0-4.fc39

Go support for Google's protocol buffers...

[SECURITY] Fedora 39 Update: golang-github-nats-io-jwt-2-2.5.2-1.fc39

JWT tokens signed using NKeys for Ed25519 for the NATS ecosystem...

[SECURITY] Fedora 39 Update: golang-github-cncf-xds-0-0.10.20230912gite9ce688.fc39

XDS API Working Group...

Security Bulletin: Multiple security vulnerabilities in Go may affect IBM Robotic Process Automation for Cloud Pak

Summary Golang Go is used by IBM Robotic Process Automation for Cloud Pak as part of the operator CVE-2023-29406, CVE-2023-29409. libp2p go-libp2p is used by IBM Robotic Process Automation for Cloud Pak as part of the operator CVE-2023-39533. Vulnerability Details CVEID: CVE-2023-29406 DESCRIPTIO...

Aws-Waf-Header-Analyzer - The Purpose Of The Project Is To Create Rate Limit In AWS WaF Based On HTTP Headers

The purpose of the project is to create rate limit in AWS WaF based on HTTP headers. Golang is a dependencie to build the binary. See the documentation to install: https://go.dev/doc/install make sudo make install The rules configuration is very simple, for example, the threshold is the limited o...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.30.2 security update

Red Hat OpenShift Serverless 1.30.2 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in t...

golang: net/http: insufficient sanitization of Host header

A flaw was found in Golang, where it is vulnerable to HTTP header injection caused by improper content validation of the Host header by the HTTP/1 client. A remote attacker can inject arbitrary HTTP headers by persuading a victim to visit a specially crafted Web page. This flaw allows the attacke...

golang: crypto/tls: slow verification of certificate chains containing large RSA keys

A denial of service vulnerability was found in the Golang Go package caused by an uncontrolled resource consumption flaw. By persuading a victim to use a specially crafted certificate with large RSA keys, a remote attacker can cause a client/server to expend significant CPU time verifying...

Important: Red Hat Security Advisory: Release of OpenShift Serverless 1.30.2

Red Hat OpenShift Serverless version 1.30.2 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

Important: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update

Migration Toolkit for Applications 6.2.1 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Security Bulletin: IBM Storage Ceph is vulnerable via use of insufficiently random values and via exposure of sensitive information to an unauthorized actor in Golang (CVE-2022-30629)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-30629 Vulnerability Details CVEID: CVE-2022-30629 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by an issue with session tickets generated by crypto/t...

Security Bulletin: IBM Storage Ceph is vulnerable to a panic in Golang (CVE-2022-28327)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-28327 Vulnerability Details CVEID: CVE-2022-28327 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validaiton by the generic P-256 feature in crypto/elliptic. B...

Security Bulletin: IBM Storage Ceph is vulnerable to a denial of service vulnerablity in Golang Go

Summary Golang Go is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-41721, CVE-2022-27664, CVE-2022-30633, CVE-2022-28131. Vulnerability Details CVEID: CVE-2022-41721 DESCRIPTION: Golang Go is vulnerable to HTTP request smuggling, caused by a flaw when using...