Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc (important)

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc Announcement ID: openSUSE-SU-2019:0295-1 Rating: important References: 1048046 1051429 1114832 1118897 1118898 1118899 1121967 1124308 Cross-References: CVE-2018-16873 CVE-2018-168...

A week in security (February 25 – March 3)

Last week, we delved into the realm of K-12 schools and security, explored the world of compromised websites and Golang bruteforcers, and examined the possible realms of pay for privacy. We also looked at identity management solutions, Google’s Universal Read Gadget, and did the deepest of dives...

SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork, runc (SUSE-SU-2019:0495-1)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues : Security issues fixed : CVE-2018-16875: Fixed a CPU Denial of Service bsc1118899. CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPA...

New Golang brute forcer discovered amid rise in e-commerce attacks

E-commerce websites continue to be targeted by online criminals looking to steal personal and payment information directly from unaware shoppers. Recently, attacks have been conducted via skimmer, which is a piece of code that is either directly injected into a hacked site or referenced externall...

[SECURITY] Fedora 28 Update: golang-1.10.8-1.fc28

The Go Programming Language...

Fedora Update for golang FEDORA-2019-6cf96757fe

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

New Relic: Password theft login.newrelic.com via Request Smuggling

Hi, The Rails application at login.newrelic.com is accessed through a proxy written in Golang, and an nginx server. By sending an ambiguous request, an attacker can desynchronize these servers, leaving the socket to the backend poisoned with a harmful response. This response will then be served u...

openSUSE Security Update : docker (openSUSE-2019-189)

This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues : Security issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork : - CVE-2018-16873: cmd/go: remote command execution during 'go get -u' bsc1118897 -...

openSUSE: Security Advisory for docker (openSUSE-SU-2019:0189-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Updated golang packages fix security vulnerability

Remote code execution in go get, when executed with the -u flag CVE-2018-16873. An arbitrary filesystem write in go get, which could lead to code execution CVE-2018-16874. Denial of Service in the crypto/x509 package during certificate chain validation CVE-2018-16875. Go before 1.11.5 mishandles...

MGASA-2019-0066 Updated golang packages fix security vulnerability

Remote code execution in go get, when executed with the -u flag CVE-2018-16873. An arbitrary filesystem write in go get, which could lead to code execution CVE-2018-16874. Denial of Service in the crypto/x509 package during certificate chain validation CVE-2018-16875. Go before 1.11.5 mishandles...

SUSE SLED15 / SLES15 Security Update : docker (SUSE-SU-2019:0286-1)

This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues : Security issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork : CVE-2018-16873: cmd/go: remote command execution during 'go get -u' bsc1118897...

Debian DLA-1664-1 : golang security update

It was discovered that there was a denial of service vulnerability or possibly even the ability to conduct private key recovery attacks within in the elliptic curve cryptography handling in the Go programming language libraries. For Debian 8 'Jessie', this issue has been fixed in golang version...

[SECURITY] [DLA 1664-1] golang security update

Package : golang Version : 2:1.3.3-1+deb8u1 CVE ID : CVE-2019-6486 Debian Bug : 920548 It was discovered that there was a denial of service vulnerability or possibly even the ability to conduct private key recovery attacks within in the elliptic curve cryptography handling in the Go programming...

DLA-1664-1 golang - security update

Bulletin has no description...

Debian: Security Advisory (DLA-1664-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 29 Update: golang-1.11.5-1.fc29

The Go Programming Language...

Fedora 29 : golang (2019-dbd82d0882)

Security fix for CVE-2019-6486 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Debian DSA-4380-1 : golang-1.8 - security update

A vulnerability was discovered in the implementation of the P-521 and P-384 elliptic curves, which could result in denial of service and in some cases key recovery. In addition this update fixes two vulnerabilities in 'go get', which could result in the execution of arbitrary shell commands. C...

Debian DSA-4379-1 : golang-1.7 - security update

A vulnerability was discovered in the implementation of the P-521 and P-384 elliptic curves, which could result in denial of service and in some cases key recovery. In addition this update fixes a vulnerability in 'go get', which could result in the execution of arbitrary shell commands. C Tenabl...