CVE-2023-29403 Unsafe behavior in setuid/setgid binaries in runtime

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I...

CVE-2023-29403 Unsafe behavior in setuid/setgid binaries in runtime

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I...

Incorrect Privilege Assignment

Overview std/runtime is a Go standard library package std/runtime Affected versions of this package are vulnerable to Incorrect Privilege Assignment. Go Vulnerability Report:On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be...

GO-2023-1840 Unsafe behavior in setuid/setgid binaries in runtime

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I...

CVE-2023-29403

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I...

SUSE-SU-2023:2185-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: prometheus-postgresexporter: - Security issues fixed: CVE-2022-46146: Fix authentication bypass via cache poisoning bsc1208060 - Other non-security issues fixed: Adapt the systemd service security configuration to be able to start it on for Red Hat Linux...

SUSE-SU-2023:2183-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-prometheus-alertmanager: - Security issues fixed: CVE-2022-46146: Fix authentication bypass via cache poisoning bsc1208051 prometheus-blackboxexporter: - Security issues fixed: CVE-2022-46146: Fix authentication bypass via cache poisoning...

Fedora: Security Advisory for golang-google-appengine (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has multiple vulnerabilities associated with the Go runtime (CVE-2021-29923, CVE-2021-31525, CVE-2021-33194, CVE-2021-33195, CVE-2021-33196, CVE-2021-33197, CVE-2021-33198)

Summary The Go runtime is used by several components in IBM Cloud Pak for Multicloud Management Monitoring to interact with the operating system and provide utility functions. Vulnerability Details CVEID:CVE-2021-34558 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by the...

[SECURITY] Fedora 35 Update: golang-google-appengine-1.6.7-5.fc35

This package supports the Go runtime on App Engine standard. It provides APIs for interacting with App Engine services...

[SECURITY] Fedora 36 Update: golang-google-appengine-1.6.7-5.fc36

This package supports the Go runtime on App Engine standard. It provides APIs for interacting with App Engine services...

Uncontrolled Search Path Element

Overview std/runtime is a Go standard library package std/runtime Affected versions of this package are vulnerable to Uncontrolled Search Path Element. Go Vulnerability Report: via the LoadLibrary process. An attacker can execute arbitrary code by placing a malicious DLL in a location where it wi...

SUSE-RU-2021:3315-1 Recommended update for go1.17

This update for go1.17 fixes the following issues: This is the initial go 1.17 shipment. go1.17.1 released 2021-09-09 includes a security fix to the archive/zip package, as well as bug fixes to the compiler, linker, the go command, and to the crypto/rand, embed, go/types, html/template, and...

A failed upgrade may lead to hung goroutines

Impact Processes using tableflip may encounter hung goroutines in the parent process, after a failed upgrade. The Go runtime has annoying behaviour around setting and clearing ONONBLOCK: exec.Cmd.Start ends up calling os.File.Fd for any file in exec.Cmd.ExtraFiles. os.File.Fd disables both the us...

GHSA-GMQ2-39FF-F5QG A failed upgrade may lead to hung goroutines

Impact Processes using tableflip may encounter hung goroutines in the parent process, after a failed upgrade. The Go runtime has annoying behaviour around setting and clearing ONONBLOCK: exec.Cmd.Start ends up calling os.File.Fd for any file in exec.Cmd.ExtraFiles. os.File.Fd disables both the us...

CVE-2019-25014

A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic resulting in a denial of service to the istio-pilot...

Security Bulletin: IBM Event Streams is affected by a vulnerability in the Go runtime (CVE-2020-16845)

Summary IBM Event Streams is affected by a vulnerability in the Go runtime Vulnerability Details CVEID: CVE-2020-16845 DESCRIPTION: Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. By sending a specially-crafted...