GO-2024-3246 Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault

Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault...

GO-2024-3245 Ollama Out-of-bounds Read in github.com/ollama/ollama

Ollama Out-of-bounds Read in github.com/ollama/ollama...

Gnark out-of-memory during deserialization with crafted inputs

Thanks @pventuzelo for reporting. From the correspondence: Hi, We Fuzzinglabs & Lambdaclass found that during deserialization of certain files representing a VerifyingKey, an excessive memory allocation is happening consuming a lot of resources and even triggering a crash with the error fatal...

GO-2024-3203 VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder...

CVE-2024-44337

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the...

GO-2024-3196 Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. in github.com/codeclysm/extract

Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. in github.com/codeclysm/extract...

CVE-2024-44337: Undefined Security Weakness

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the...

CVE-2024-44337

The github.com/gomarkdown/markdown Go library, used for parsing Markdown text into HTML, contains a logical flaw in the paragraph function within parser/block.go. This vulnerability allows a remote attacker to trigger an infinite loop by providing specifically crafted input, leading to a Denial o...

CVE-2024-44337

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the...

CVE-2024-44337

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the...

CVE-2024-44337

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the...

GO-2024-3181 PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd

PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd...

GO-2024-3174 Vulnerable juju hook tool abstract UNIX domain socket in github.com/juju/juju

Vulnerable juju hook tool abstract UNIX domain socket in github.com/juju/juju...

GO-2024-3167 Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

GO-2024-3163 Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle

Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...

GO-2024-3161 Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher

Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3138 ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3158 Apache Answer: Avatar URL leaked user email addresses in github.com/apache/incubator-answer

Apache Answer: Avatar URL leaked user email addresses in github.com/apache/incubator-answer...

GO-2024-3137 ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2024-3160 Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials in github.com/ory/kratos

Ory Kratos's setting requiredaal highestavailable does not properly respect code + mfa credentials in github.com/ory/kratos...