474 matches found
CVE-2024-8260: Authentication Bypass by Capture-replay
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...
openSUSE 15 Security Update : apptainer (openSUSE-SU-2024:0244-1)
The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0244-1 advisory. - Make sure, digest values handled by the Go library github.com/opencontainers/go-digest and used throughout the Go-implemented containers...
openSUSE Security Advisory (openSUSE-SU-2024:0244-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OPENSUSE-SU-2024:0244-1 Security update for apptainer
This update for apptainer fixes the following issues: - Make sure, digest values handled by the Go library github.com/opencontainers/go-digest and used throughout the Go-implemented containers ecosystem are always validated. This prevents attackers from triggering unexpected authenticated registr...
golang: archive/zip: Incorrect handling of certain ZIP files
A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next...
Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials
...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in Kubernetes [CVE-2019-11250]
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in Kubernetes, caused by storing credentials in the log by the client-go library CVE-2019-11250. Kubernetes is included in the Speech utilities used by our service. This...
AZL-42395 CVE-2024-24790 affecting package golang for versions less than 1.22.3-1
The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...
AZL-40436 CVE-2024-24788 affecting package msft-golang for versions less than 1.22.3
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop...
AZL-39851 CVE-2024-22189 affecting package coredns for versions less than 1.11.1-6
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of NEWCONNECTIONID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a...
AZL-37457 CVE-2024-24785 affecting package golang for versions less than 1.21.6-1
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates...
AZL-35422 CVE-2023-50658 affecting package telegraf for versions less than 1.29.4-1
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
DEBIAN-CVE-2023-50658
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
UBUNTU-CVE-2023-50658
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
Design/Logic Flaw
stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary director...
CVE-2024-24579
The set of documents identifies a path-traversal vulnerability in the Go library stereoscope (containers/image processing). Specifically, the CVE-2024-24579 entry describes a flaw prior to v0.0.1 where crafting an OCI tar archive can cause writes to paths outside the unarchive temporary directory...
CVE-2023-49568
A denial of service DoS vulnerability was found in the go library go-git. This issue may allow an attacker to perform denial of service attacks by providing specially crafted responses from a Git server, which can trigger resource exhaustion in go-git clients. Mitigation In cases where a bump to...
git-urls Security Vulnerabilities
git-urls is a Go library from Will Maier's personal developer. It is used to parse Git URLs. A security vulnerability exists in git-urls version 1.0.1. An attacker could exploit this vulnerability to conduct a regular expression denial of service attack...
AZL-37425 CVE-2023-45284 affecting package golang for versions less than 1.21.6-1
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports the...