[SECURITY] [DLA 1148-1] golang security update

Package : golang Version : 2:1.0.2-1.1+deb7u2 CVE ID : CVE-2017-15041 Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points...

DLA-1148-1 golang - security update

Bulletin has no description...

Fedora Update for golang FEDORA-2017-8f7bca960b

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for golang FEDORA-2017-6f1b90dbb7

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 25 : golang (2017-8f7bca960b)

Security fix for CVE-2017-15041 and CVE-2017-15042 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

[SECURITY] Fedora 25 Update: golang-1.7.6-3.fc25

The Go Programming Language...

Fedora 26 : golang (2017-6f1b90dbb7)

Security fix for CVE-2017-15041 and CVE-2017-15042 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

[SECURITY] Fedora 26 Update: golang-1.8.4-1.fc26

The Go Programming Language...

[SECURITY] Fedora 27 Update: golang-1.9.1-1.fc27

The Go Programming Language...

UPDATE: Cameradar v2.0.0

PenTestIT RSS Feed My initial post covering this open source Real Time Streaming Protocol RTSP surveillance camera access multi-tool was about an older version. A lot has happened since then and an update - Cameradar v2.0.0 was made available by the authors. What is Cameradar? Cameradar is an RTS...

Debian DLA-1123-1 : golang security update

It was discovered that there was an issue in the Go programming language library where an attacker could generate a MIME request such that the server ran out of file descriptors. For Debian 7 'Wheezy', this issue has been fixed in golang version 2:1.0.2-1.1+deb7u1. We recommend that you upgrade...

[SECURITY] [DLA 1123-1] golang security update

Package : golang Version : 2:1.0.2-1.1+deb7u1 CVE ID : CVE-2017-1000098 It was discovered that there was an issue in the Go programming language library where an attacker could generate a MIME request such that the server ran out of file descriptors. For Debian 7 "Wheezy", this issue has been fix...

Man-in-the-Middle (MitM)

github.com/golang/go is vulnerable to man-in-the-middle MitM attack. A malicious user can set up a MitM SMTP server that doesn't advertise STARTTLS and advertises that PLAIN authentication can be used. By doing this, smtp.PlainAuth will send the username and password will be sent to the server...

Remote Code Execution (RCE)

github.com/golang/go is vulnerable to remote code execution RCE. If custom domains are used, a malicious user can set a domain example.com/proj1 to point to a subversion repository and another domain example.com/proj1/proj2 to point to a git repository. When the go get command is run, arbitrary...

DLA-1123-1 golang - security update

Bulletin has no description...

Denial Of Service (DoS) Via Multipart Request

net/http in github.com/golang/go is vulnerable to denial of service DoS attacks. The attacks exist because Request.ParseMultipartForm begins writing temporary files regardless of the request body size surpassing the given "maxMemory" limit. Attacker can send malicious multipart request to consume...

Untrusted Certificate Validation

crypto/x509 in github.com/golang/go uses untrusted certificates for validation. When used on Darwin, golang will use an untrusted root certificate as if it were trusted when verifying connections...

CVE-2017-1000098

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors...

EulerOS 2.0 SP2 : golang (EulerOS-SA-2017-1225)

According to the version of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A carry propagation flaw was found in the implementation of the P-256 elliptic curve in golang. An attacker could possibly use this flaw to extract...

CentOS 7 : golang (CESA-2017:1859)

An update for golang is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...