523 matches found
AZL-55094 CVE-2025-21613 affecting package packer for versions less than 1.9.5-7
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only...
AZL-55079 CVE-2025-21614 affecting package packer for versions less than 1.9.5-7
go-git is a highly extensible git implementation library written in pure Go. A denial of service DoS vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git serve...
AZL-55060 CVE-2025-21613 affecting package packer for versions less than 1.9.5-5
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only...
AZL-54401 CVE-2024-45338 affecting package packer for versions less than 1.9.5-7
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...
AZL-54510 CVE-2024-45338 affecting package packer for versions less than 1.9.5-7
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...
AZL-54290 CVE-2024-45337 affecting package packer for versions less than 1.9.5-5
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
AZL-54330 CVE-2024-45337 affecting package packer for versions less than 1.9.5-4
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
CVE-2024-24786 affecting package packer for versions less than 1.9.5-3
CVE-2024-24786 affecting package packer for versions less than 1.9.5-3. A patched version of the package is available...
LodaRAT: Established Malware, New Victim Patterns
Executive Summary Rapid7 has observed an ongoing malware campaign involving a new version of LodaRAT. This version possesses the ability to steal cookies and passwords from Microsoft Edge and Brave. LodaRAT, first observed in 2016, is a remote access tool RAT written in AutoIt. Development of...
AZL-52233 CVE-2024-51744 affecting package packer for versions less than 1.9.5-12
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
AZL-52189 CVE-2024-51744 affecting package packer for versions less than 1.9.5-9
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
CBL Mariner 2.0 Security Update: packer (CVE-2023-49569)
The version of packer installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-49569 advisory. - A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows a...
CBL Mariner 2.0 Security Update: packer (CVE-2023-49568)
The version of packer installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-49568 advisory. - A denial of service DoS vulnerability was discovered in go-git versions prior to v5.11. This vulnerability...
CVE-2023-48795 affecting package packer for versions less than 1.9.5-1
CVE-2023-48795 affecting package packer for versions less than 1.9.5-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-49569 affecting package packer for versions less than 1.9.5-1
CVE-2023-49569 affecting package packer for versions less than 1.9.5-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-45288 affecting package packer for versions less than 1.9.5-1
CVE-2023-45288 affecting package packer for versions less than 1.9.5-1. A patched version of the package is available...
CVE-2023-49568 affecting package packer for versions less than 1.9.5-1
CVE-2023-49568 affecting package packer for versions less than 1.9.5-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-39325 affecting package packer for versions less than 1.9.5-1
CVE-2023-39325 affecting package packer for versions less than 1.9.5-1. An upgraded version of the package is available that resolves this issue...