Important: go-toolset and golang security and bug fix update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fixes: golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30631 golang: net/http: improper sanitization...

RHEL 8 : go-toolset:rhel8 (RHSA-2022:5775)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5775 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang:...

OESA-2022-1783 golang security update

The Go Programming Language Security Fixes: When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more...

EulerOS Virtualization 2.9.1 : expat (EulerOS-SA-2022-2178)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character ...

EulerOS Virtualization 2.9.0 : expat (EulerOS-SA-2022-2197)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character ...

Denial Of Service (DoS)

go is vulnerable to Denial Of Service DoS. The vulnerability exists in Glob function in match.go due to stack exhaustion because having a large number of path separators in Glob which allows an attacker to cause an application crash...

Denial Of Service (DoS)

go is vulnerable to denial of service. The vulnerability exists in unmarshalAttr function in read.go due to improper encoding which allows an attacker to cause a stack exhaustion in Unmarshal which leads to an application crash...

Denial Of Service (DoS)

go is vulnerable to Denial Of Service DoS. Calling Decoder.Decode on a message which contains deeply nested structures may cause a system crash due to stack exhaustion...

Denial Of Service (DoS)

go is vulnerable to denial of service attacks. The vulnerability exists because, when calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files may cause a panic due to stack exhaustion...

Denial Of Service (DoS)

go is vulnerable to denial of service. The vulnerability exists in Skip function in read.go due to a stack exhaustion in decoder.Skip which allows an attacker to cause an application crash...

Denial Of Service (DoS)

go is vulnerable to Denial Of Service DoS. The vulnerability exists in functions in parser.go because of a stack exhaustion which allows an attacker to cause an application crash...

OESA-2022-1756 libproxy security update

libproxy offers the following features: extremely small core footprint 35k. no external dependencies within libproxy core.libproxy plugins may have dependencies. only 3 functions in the stable external API. dynamic adjustment to changing network topology. a standard way of dealing with proxy...

AlmaLinux 8 : expat (5314) (ALSA-2022:5314)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5314 advisory. - In Expat aka libexpat before 2.4.5, an attacker can trigger stack exhaustion in buildmodel via a large nesting depth in the DTD element. CVE-2022-25313 ...

Uncontrolled Recursion

Overview std/io/fs is a Go standard library package std/io/fs Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report: Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion. Remediation Upgrade...

GO-2022-0526 Stack exhaustion when decoding certain messages in encoding/gob

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion...

Uncontrolled Recursion

Overview std/encoding/gob is a Go standard library package std/encoding/gob Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion...

Uncontrolled Recursion

Overview std/compress/gzip is a Go standard library package std/compress/gzip Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report: via the Reader.Read function when processing an archive that contains a large number of concatenated zero-length...

GO-2022-0524 Stack exhaustion when reading certain archives in compress/gzip

Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion...

GO-2022-0523 Stack exhaustion when unmarshaling certain documents in encoding/xml

Unmarshaling an XML document into a Go struct which has a nested field that uses the 'any' field tag can panic due to stack exhaustion...

Uncontrolled Recursion

Overview std/path/filepath is a Go standard library package std/path/filepath Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report: Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion...