go-toolset:rhel8 security, bug fix, and enhancement update

An update is available for delve, golang, go-toolset. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset provides the Go programming language tools and...

go-dns:fuzz_msg_unpack: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=4697630979522560 Project: go-dns Fuzzing Engine: libFuzzer Fuzz Target: fuzzmsgunpack Job Type: libfuzzerasango-dns Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

gcloud-go:fuzz_parse_query: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6062954056384512 Project: gcloud-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzparsequery Job Type: libfuzzerasangcloud-go Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

cilium:fuzz: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5202243180691456 Project: cilium Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasancilium Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

fasthttp:fuzz_url: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5551040360480768 Project: fasthttp Fuzzing Engine: libFuzzer Fuzz Target: fuzzurl Job Type: libfuzzerasanfasthttp Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

kubernetes:fuzz_write_token: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5832805960515584 Project: kubernetes Fuzzing Engine: libFuzzer Fuzz Target: fuzzwritetoken Job Type: libfuzzerasankubernetes Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

jsonparser:fuzzparsestring: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5490923074093056 Project: jsonparser Fuzzing Engine: libFuzzer Fuzz Target: fuzzparsestring Job Type: libfuzzerasanjsonparser Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

golang: cmd/go: packages using cgo can cause arbitrary code execution at build time

A flaw was found in golang: cmd/go, in which Go can execute arbitrary commands at build time when cgo is in use on Windows OS. On Linux/Unix, only users who have "." listed explicitly in their PATH variable are affected. The highest threat from this vulnerability is to data confidentiality and...

cosmos-sdk:fuzz_types_dec_setstring: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=4830166565126144 Project: cosmos-sdk Fuzzing Engine: libFuzzer Fuzz Target: fuzztypesdecsetstring Job Type: libfuzzerasancosmos-sdk Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

golang-protobuf:wirefuzz: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5917153682391040 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

go-redis:fuzz: Crash in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5940588886228992 Project: go-redis Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasango-redis Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x618000000080 Crash State: pthreadcreate cgotrypthreadcreate Sanitizer:...

GO-2021-0068 Arbitrary code injection via the go command with cgo on Windows in cmd/go

The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get on a malicious module, or any other time the code is built...

cascadia:fuzz: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6383553077182464 Project: cascadia Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasancascadia Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

thrift:fuzz_go_tutorial: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6261759750045696 Project: thrift Fuzzing Engine: libFuzzer Fuzz Target: fuzzgotutorial Job Type: libfuzzerasanthrift Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

go-ethereum:fuzz_g1_multiexp: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5769867430068224 Project: go-ethereum Fuzzing Engine: libFuzzer Fuzz Target: fuzzg1multiexp Job Type: libfuzzerasango-ethereum Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

go-snappy:fuzz_roundtrip: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=4749622519136256 Project: go-snappy Fuzzing Engine: libFuzzer Fuzz Target: fuzzroundtrip Job Type: libfuzzerasango-snappy Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

cascadia:fuzz: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5429761745747968 Project: cascadia Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasancascadia Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

gcloud-go:fuzz_parse_query: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5172013004095488 Project: gcloud-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzparsequery Job Type: libfuzzerasangcloud-go Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

CentOS 8 : go-toolset:rhel8 (CESA-2020:5493)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5493 advisory. - golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS CVE-2020-24553 - golang: math/big: panic during recursive...

golang:gzip: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5179525291966464 Project: golang Fuzzing Engine: libFuzzer Fuzz Target: gzip Job Type: libfuzzerasangolang Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate xcgosysthreadcreate Sanitizer...