Important Photon OS Security Update - PHSA-2023-4.0-0531

Updates of 'go', 'vim' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-5.0-91-0176

Updates of 'go', 'vim' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-5.0-0176

Updates of 'vim', 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-3.0-0702

Updates of 'vim', 'go' packages of Photon OS have been released...

GHSA-J3RQ-4XJW-XG63 Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks

Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. Patches The issue has been patched in v1.4.0 Workarounds Directly using the...

CVE-2023-49292 Possible private key restoration in go package github.com/ecies/go

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate, Decapsulate and ECDH could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade...

PT-2023-36290 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...

GHSA-3F2Q-6294-FMQ5 Inefficient Regular Expression Complexity in git-urls

git-urls version 1.0.1 is vulnerable to ReDOS Regular Expression Denial of Service in Go package...

Inefficient Regular Expression Complexity in git-urls

git-urls version 1.0.1 is vulnerable to ReDOS Regular Expression Denial of Service in Go package...

CVE-2023-46402

Git-URLs 1.0.0 is vulnerable to a Regular Expression Denial of Service (ReDOS) in urls.go. Connected Fedora advisories confirm a bugfix mitigating CVE-2023-46402, e.g., updating to golang-github-chainguard-dev-git-urls 1.0.2 for Fedora 41. No additional exploit details are provided in the connect...

OPENSUSE-SU-2023:0360-1 Security update for go1.21

This update introduces go1.21, including fixes for the following issues: - go1.21.3 released 2023-10-10 includes a security fix to the net/http package. Refs boo1212475 go1.21 release tracking CVE-2023-39325 CVE-2023-44487 go63427 go63417 boo1216109 security: fix CVE-2023-39325 CVE-2023-44487...

Rocky Linux 8 : go-toolset:rhel8 (RLSA-2021:1746)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1746 advisory. - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb duri...

PT-2023-36285 · Unknown · Cni-Plugins

Name of the Vulnerable Software and Affected Versions: cni-plugins affected versions not specified Description: The issue is related to a security release in the go 1.21 package, which is used to rebuild the cni-plugins package. Recommendations: At the moment, there is no information about a newe...

PT-2023-36258 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The update rebuilds the container-suseconnect package with this security release. No information is provided...

PT-2023-36247 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.20 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...

CVE-2023-29409

A denial of service vulnerability was found in the Golang Go package caused by an uncontrolled resource consumption flaw. By persuading a victim to use a specially crafted certificate with large RSA keys, a remote attacker can cause a client/server to expend significant CPU time verifying...

PT-2023-36201 · Go +1 · Go +1

Name of the Vulnerable Software and Affected Versions: kubernetes version 1.24 Description: The issue is related to a security release in the go 1.20 package, which is used by kubernetes. The package has been rebuilt with the go 1.20 security release to address the issue. Recommendations: For...

PT-2023-36204 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: cosign affected versions not specified Description: The issue is related to a security release in the go 1.20 package. The cosign package has been rebuilt with this security release to address the issue. No information is provided about the...

GHSA-MV7X-27PC-8C96 Go package pydio/cells vulnerable to authorization bypass

A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. Upgrading to version 4.2.1 is able to address this issue. I...

PT-2023-36181 · Go +1 · Go +1

Name of the Vulnerable Software and Affected Versions: kubernetes1.18 version 1.18 Description: The issue is related to a security release in the go 1.19 package, which is used by kubernetes1.18. The package has been rebuilt with the go 1.19 security release to address the issue. Recommendations:...