Amazon Linux 2 : golang, --advisory ALAS2-2022-1830 (ALAS-2022-1830)

The version of golang installed on the remote host is prior to 1.18.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1830 advisory. A null pointer dereference vulnerability was found in golang. When using the library's ssh server without specifying an...

Important: golang

Issue Overview: An out of bounds read vulnerability was found in golang. When using the archive/zip standard library stdlib and an unexpected file is parsed, it can cause golang to attempt to read outside of a slice array causing a panic in the runtime. A potential attacker can use this...

Fedora: Security Advisory for golang (FEDORA-2021-6a3024b3fd)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2021-27919, CVE-2021-27918)

Summary IBM Cloud Private is vulnerable to a Go vulnerability Vulnerability Details CVEID: CVE-2021-27919 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the Reader.Open API when use a ZIP archive containing files start with “../”. By persuading a victim to open a...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Golang (CVE-2021-27919)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2021-27919 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the Reader.Open API when use a ZIP archive containing files start with “../”. By persuading a victim to...

Security Bulletin: Operations Dashboard is vulnerable to Go vulnerabilities (CVE-2021-27918 and CVE-2021-27919)

Summary Operations Dashboard is vulnerable to Go vulnerabilities CVE-2021-27918 and CVE-2021-27919 with details of each below. Vulnerability Details CVEID: CVE-2021-27918 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an infinite loop flaw when using xml.NewTokenDecoder wi...

SUSE: Security Advisory (SUSE-SU-2021:0937-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 Security Update : go1.16 (SUSE-SU-2021:0937-1)

This update for go1.16 fixes the following issues : go1.16.2 released 2021-03-11 bsc1182345 go1.16.1 released 2021-03-10 bsc1182345 - CVE-2021-27918: Fixed an infinite loop when using xml.NewTokenDecoder with a custom TokenReader bsc1183333. - CVE-2021-27919: Fixed an issue where archive/zip: can...

SUSE-SU-2021:0937-1 Security update for go1.16

This update for go1.16 fixes the following issues: - go1.16.2 released 2021-03-11 bsc1182345 - go1.16.1 released 2021-03-10 bsc1182345 - CVE-2021-27918: Fixed an infinite loop when using xml.NewTokenDecoder with a custom TokenReader bsc1183333. - CVE-2021-27919: Fixed an issue where archive/zip:...

CVE-2021-27919

archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service panic upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename...

CVE-2021-27919

CVE-2021-27919 affects the Go standard library archive/zip: parsing ZIP archives where a filename begins with ../ can trigger a panic/denial of service in Go 1.16.x prior to 1.16.1 due to an unsafe Reader.Open path handling. Affected product: Go (archive/zip). Root cause: insufficient validation ...

CVE-2021-27919

archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service panic upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename...

CVE-2021-27919

archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service panic upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename...

CVE-2021-27919

archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service panic upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename...

Security fix for the ALT Linux 9 package golang version 1.15.9-alt1

March 11, 2021 Alexey Shabalin 1.15.9-alt1 - New version 1.15.9. - Fixes: + CVE-2021-27918 + CVE-2021-27919...

Security fix for the ALT Linux 10 package golang version 1.16.1-alt1

March 11, 2021 Alexey Shabalin 1.16.1-alt1 - New version 1.16.1. - Fixes: + CVE-2021-27918 + CVE-2021-27919 - Remove test for other platform scripts...