Debian: Security Advisory (DLA-2454-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2455-1 : packer security update

golang-go.crypto was recently updated with a fix for CVE-2020-9283. This in turn requires all packages that use the affected code to be recompiled in order to pick up the security fix. CVE-2020-9283 SSH signature verification could cause Panic when given invalid Public key. For Debian 9 stretch,...

Debian DLA-2454-1 : rclone security update

golang-go.crypto was recently updated with a fix for CVE-2019-11840. This in turn requires all packages that use the affected code to be recompiled in order to pick up the security fix. CVE-2019-11840 An issue was discovered in supplementary Go cryptography libraries, aka...

[SECURITY] [DLA 2455-1] packer security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2455-1 [email protected] https://www.debian.org/lts/security/ Brian May November 19, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2454-1] rclone security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2454-1 [email protected] https://www.debian.org/lts/security/ Brian May November 19, 2020 https://wiki.debian.org/LTS -...

AZL-79068 CVE-2020-28362 affecting package golang 1.25.7-1

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service...

Medium: golang

Issue Overview: Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. CVE-2020-24553 Affected Packages: golang Issue Correction: Run yum update golang or yum update --advisory ALAS-2020-1445 to update your...

Amazon Linux AMI : golang (ALAS-2020-1445)

The version of golang installed on the remote host is prior to 1.15.3-1.63. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1445 advisory. Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a...

Debian DLA-2453-1 : restic security update

golang-go.crypto was recently updated with a fix for CVE-2020-9283. This in turn requires all packages that use the affected code to be recompiled in order to pick up the security fix. CVE-2020-9283 SSH signature verification could cause Panic when given invalid Public key. For Debian 9 stretch,...

MGASA-2020-0424 Updated golang packages fix a security vulnerability

A flaw was found in Go standard library packages. Both the net/http/cgi and net/http/fcgi packages use a default Content-Type response header value of "text/html", rather than "text/plain". An attacker could exploit this in applications using these packages by uploading crafted files, allowing fo...

Security fix for the ALT Linux 10 package golang version 1.15.5-alt1

Nov. 14, 2020 Alexey Shabalin 1.15.5-alt1 - New version 1.15.5. - Fixes: + CVE-2020-28362 + CVE-2020-28366 + CVE-2020-28367...

Security fix for the ALT Linux 9 package golang version 1.15.5-alt1

Nov. 14, 2020 Alexey Shabalin 1.15.5-alt1 - New version 1.15.5. - Fixes: + CVE-2020-28362 + CVE-2020-28366 + CVE-2020-28367...

Amazon Linux 2 : golang (ALAS-2020-1554)

The version of golang installed on the remote host is prior to 1.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1554 advisory. Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Typ...

Medium: golang

Issue Overview: Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. CVE-2020-24553 Affected Packages: golang Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

grafana security, bug fix, and enhancement update

6.7.4-3 - apply patch for CVE-2020-13430 also to sources, not only to compiled webpack 6.7.4-2 - security fix for CVE-2020-13430 6.7.4-1 - update to 6.7.4 tagged upstream community sources, see CHANGELOG - security fix for CVE-2020-13379 6.7.3-1 - update to 6.7.3 tagged upstream community sources...

Debian DLA-2442-1 : obfs4proxy security update

golang-go.crypto was recently updated with a fix for CVE-2019-11840. This in turn requires all packages that use the affected code to be recompiled in order to pick up the security fix. CVE-2019-11840 An issue was discovered in supplementary Go cryptography libraries, aka...

[SECURITY] [DLA 2442-1] obfs4proxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2442-1 [email protected] https://www.debian.org/lts/security/ Brian May November 10, 2020 https://wiki.debian.org/LTS -...