Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.7.4 security update

Red Hat OpenShift Container Platform release 4.7.4 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

RHEL 8 : OpenShift Container Platform 4.6.23 (RHSA-2021:0956)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0956 advisory. ed Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private...

RHEL 7 : OpenShift Container Platform 3.11.404 (RHSA-2021:0833)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0833 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

CVE-2020-26283

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown,...

Design/Logic Flaw

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown,...

CVE-2020-26283

CVE-2020-26283 affects go-ipfs prior to v0.8.0, where control characters are not escaped in console output, potentially enabling a user to be tricked into performing unintended actions. The issue is clearly described across multiple sources (GitHub advisory GHSA-r4gv-vj59-cccm and OSV/CVE records...

CVE-2020-26279

The CVE-2020-26279 issue affects go-ipfs (Go implementation of IPFS): path traversal can occur when retrieving DAGs that contain relative paths, potentially overwriting files or writing to unintended output directories. The vulnerability manifests only during ipfs get operations on affected DAGs ...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2021-1678)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-1678)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.CVE-2020-28366 - Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument...

Fedora: Security Advisory for golang-github-pires-proxyproto (FEDORA-2021-f5fcd9b0c1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-containerd-cri (FEDORA-2021-f049305892)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: golang-github-pires-proxyproto-0.5.0-1.fc34

A Go library implementation of the PROXY protocol, versions 1 and 2...

[SECURITY] Fedora 33 Update: golang-github-pires-proxyproto-0.5.0-1.fc33

A Go library implementation of the PROXY protocol, versions 1 and 2...

Fedora: Security Advisory for golang-github-pires-proxyproto (FEDORA-2021-e01c1fe4cc)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 33 : golang-github-pires-proxyproto (2021-e01c1fe4cc)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-e01c1fe4cc advisory. - The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service DoS via the parseVersion1 function. The reader in this...

Another Golang Crypto Miner On the Loose

There are many crypto mining malware variants infecting systems on the internet. On Friday, March 4, 2021, I noticed an interesting hit in my honeypot logs. The binary it captured stood out, as it was rather large at 4MB. I immediately thought it would be a crypto miner written in the Go language...

USN-4856-1: docker-credential-helpers vulnerability

Jasiel Spelman discovered that docker-credential-helpers has a double free. A local attacker could use this to cause a denial of service crash or possibly execute arbitrary code...

[SECURITY] Fedora 33 Update: golang-github-containerd-cri-1.19.0-3.20210307gitaa2d5a9.fc33

Cri is a native plugin of containerd 1.1 and above. It is built into contai nerd and enabled by default...

Fedora: Security Advisory for golang-github-containerd-cri (FEDORA-2021-10ce8fcbf1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Debian DLA-2591-1 : golang-1.7 security update

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service DoS, bypasss access control, and execute arbitrary code on the developer's computer. CVE-2017-15041 Go allows 'go get' remote command execution. Using custom domains, it is possib...