3743 matches found
GO-2023-1717 Improper handling of keyspaces in vitess.io/vitess
Users can create a keyspace containing '/'. Future attempts to view keyspaces from some tools including VTAdmin and "vtctldclient GetKeyspaces" receive an error...
GO-2023-1709 Cache-timing attacks in Shamir's secret sharing in github.com/hashicorp/vault
HashiCorp Vault's implementation of Shamir's secret sharing uses precomputed table lookups, and is vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a bru...
GO-2023-1703 Backticks not treated as string delimiters in html/template
Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to...
GO-2023-1702 Infinite loop in parsing in go/scanner
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow...
GO-2023-1704 Excessive memory allocation in net/http and net/textproto
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than requir...
GO-2023-1546 Denial of service in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
The otelhttp package of opentelemetry-go-contrib is vulnerable to a denial-of-service attack. The otelhttp package uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.requestcontentlength, http.server.responsecontentlength, and http.server.duration...
GO-2023-1681 Time-of-check time-of-use race condition in github.com/containers/podman/v4
A Time-of-check Time-of-use TOCTOU flaw appears in this version of podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...
GO-2023-1631 Panic when parsing invalid messages in google.golang.org/protobuf
Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic...
GO-2023-1623 Out-of-memory panic in github.com/crossplane/crossplane-runtime
An out of memory panic vulnerability exists in the crossplane-runtime libraries. Applications that use the Paved type's SetValue method with user-provided input that is not properly validated might use excessive amounts of memory and cause an out of memory panic. In the fieldpath package, the...
GO-2023-1621 Incorrect calculation on P256 curves in crypto/internal/nistec
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...
GO-2023-1611 Path traversal in github.com/gookit/goutil
fsutil.Unzip is vulnerable to path traversal attacks due to improper validation of paths...
GO-2023-1602 Denial of service via deflate decompression bomb in github.com/russellhaering/gosaml2
A bug in SAML authentication library can result in Denial of Service attacks. Attackers can craft a "deflate"-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process bein...
GO-2023-1600 Arbitrary code execution in github.com/kitabisa/teler-waf
Improper handling of payload with special characters, such as CR/LF and horizontal tab, can lead to execution of arbitrary JavaScript code...
GO-2023-1595 Incorrect multiplication of unreduced P-256 scalars in filippo.io/nistec
Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this...
GO-2023-1569 Excessive resource consumption in mime/multipart
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request...
GO-2023-1578 Denial of service in github.com/hashicorp/go-getter/v2
HashiCorp go-getter is vulnerable to decompression bombs. This can lead to excessive memory consumption and denial-of-service attacks...
GO-2023-1571 Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests...
GO-2023-1572 Denial of service via crafted TIFF image in golang.org/x/image/tiff
An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service...
GO-2023-1570 Panic on large handshake records in crypto/tls
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session...
GO-2023-1549 Improper input validation in github.com/openshift/apiserver-library-go
Low-privileged users can set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint SCC is "runtime/default," allowing users to disable seccomp for pods they can create and modify...
GO-2023-1548 Repository access credential leak in github.com/argoproj/argo-cd/v2
Argo CD has an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API and therefor the UI or CL...
GO-2023-1558 Denial of service via malformed size parameters in github.com/ipfs/go-bitfield
When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happens when the size is a not a multiple of 8 or is negative. A workaround is to ensure size%8 == 0 && size = 0 yourself before calling NewBitfield or FromBytes...
GO-2023-1557 Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfs
Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus "fanout" parameter in the HAMT directory nodes. A workaround is to not feed untrusted user data to th...
GO-2023-1519 Command injection in github.com/rancher/wrangler
A command injection vulnerability exists in the Wrangler Git package. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host. A workaround is to sanitize input passed...
GO-2023-1515 Denial of service when processing Git credentials in github.com/rancher/wrangler
A denial of service DoS vulnerability exists in the Wrangler Git package. Specially crafted Git credentials can result in a denial of service DoS attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validati...
GO-2023-1526 Server-side request forgery in github.com/hakobe/paranoidhttp
Paranoidhttp before is vulnerable to SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...
GO-2023-1535 Panic during unmarshal of Server Hello in github.com/pion/dtls/v2
Unmarshalling a Server Hello can panic, which could allow a denial of service...
GO-2023-1534 Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
Unmarshalling a Hello Verify request can panic, which could allow a denial of service...
GO-2023-1497 Leaked user credentials in github.com/sylabs/scs-library-client
When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider...
GO-2023-1295 SQL injection in github.com/square/squalor
There is a potential for SQL injection in the table name parameter...
GO-2023-1269 Panic in encoding in github.com/ipld/go-ipld-prime
Encoding data using the 'json' codec which contains a 'Bytes' type Node will cause the encoder to panic. The decoder is not impacted. If the codec is used to encode user supplied data, this may be used as a vector for a denial of service attack...
GO-2023-1268 Authentication failure in mellium.im/sasl
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...
GO-2022-1188 Uncontrolled memory allocation in code.sajari.com/docconv
An attacker can remotely supply a specially crafted input that causes uncontrolled memory allocation...
GO-2022-1213 Insecure generation of cookies in github.com/go-macaron/csrf
The Options.Secure value is ignored, and cookies created by Generate never have the secure attribute...
GO-2022-1201 Timing attack in github.com/openshift/osin
Client secret checks are vulnerable to timing attacks, which could permit an attacker to determine client secrets...
GO-2022-1187 Open redirect vulnerability in github.com/go-macaron/i18n
A user controlled string could lead to open redirect...
GO-2022-1180 Verification rule bypass in github.com/kyverno/kyverno
A malicious proxy/registry can bypass verifyImages rules...
GO-2022-1165 Denial of service via repository index file in helm.sh/helm/v3
Applications that use the repo package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The repo package contains a handler that processes the index file of a repository. For example, the Helm client adds reference...
GO-2022-1166 Denial of service via schema file in helm.sh/helm/v3
Certain JSON schema validation files can cause a Helm Client to panic, leading to a possible denial of service. The chartutil package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The...
GO-2022-1178 JWT leak in github.com/bradleyfalzon/ghinstallation
Errors returned by ghinstallation.Transport can include the JWT used for the failed operation. If the error is exposed to an untrusted party, this JWT could be extracted and used to authenticate further requests...
GO-2022-1159 Path traversal in github.com/containers/podman/v4
The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality...
GO-2022-1118 Improper validation of UUIDs in github.com/codenotary/immudb
A malicious server can trick a client into treating it as a different server by changing the reported UUID. immudb client SDKs use the server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple server...
GO-2022-1175 Exposure of local files in github.com/cortexproject/cortex
A malicious actor could remotely read local files by submitting to the Alertmanager Set Configuration API maliciously crafted inputs. Only users of the Alertmanager service where "-experimental.alertmanager.enable-api" or "enableapi: true" is configured are affected...
GO-2022-1167 Denial of service in string value parsing in helm.sh/helm/v3
Applications that use the strvals package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes an error that cannot be recovered from. The strvals package contains a parser that turns strings into Go structures. For example, the Helm client has comman...
GO-2022-1148 Resource exhaustion in github.com/libp2p/go-libp2p
go-libp2p is vulnerable to targeted resource exhaustion attacks. These attacks target libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory ultimately leading to the process getting killed by the host's operating system. While a...
GO-2022-1113 Server-side request forgery in github.com/oam-dev/kubevela
When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability...
GO-2022-1114 ZipSlip when unzipping files in github.com/duke-git/lancet
A ZipSlip vulnerability exists when using the fileutil package to unzip files...
GO-2022-1143 Restricted file access on Windows in os and net/http
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS"C:/tmp".Open"COM1" opens the...
GO-2022-1130 Authentication bypass in github.com/prometheus/exporter-toolkit
If an attacker has access to a Prometheus web.yml file and users' bcrypted passwords, it would be possible to bypass security via the built-in authentication cache...