4632 matches found
GO-2022-0533 Path traversal via Clean on Windows in path/filepath
On Windows, the filepath.Clean function can convert certain invalid paths to valid, absolute paths, potentially allowing a directory traversal attack. For example, Clean".\c:" returns "c:"...
GO-2022-0531 Session tickets lack random ticket_age_add in crypto/tls
An attacker can correlate a resumed TLS session with a previous connection. Session tickets generated by crypto/tls do not contain a randomly generated ticketageadd, which allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during sessio...
GO-2022-0476 Arbitrary code execution via the go command with cgo in cmd/go
The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious gcc flags specified via a cgo directive...
GO-2022-0475 Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious unquoted symbol name in a linked object file...
GO-2022-0520 Exposure of client IP addresses in net/http
Client IP adresses may be unintentionally exposed via X-Forwarded-For headers. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy sets the client IP as the value of the X-Forwarded-For header, contrary to it...
GO-2022-0316 Incorrect calculation in github.com/open-policy-agent/opa
Pretty-printing an AST that contains synthetic nodes can change the logic of some statements by reordering array literals...
GO-2022-0355 Path traversal in github.com/valyala/fasthttp
The fasthttp.FS request handler is vulnerable to directory traversal attacks on Windows systems, and can serve files from outside the provided root directory. URL path normalization does not handle Windows path separators backslashes, permitting an attacker to construct requests with relative pat...
GO-2022-0532 Empty Cmd.Path can trigger unintended binary in os/exec on Windows
On Windows, executing Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset will unintentionally trigger execution of any binaries in the working directory named either "..com" or "..exe"...
GO-2022-0525 Improper sanitization of Transfer-Encoding headers in net/http
The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid...
GO-2022-0527 Stack exhaustion in Glob on certain paths in io/fs
Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion...
GO-2022-0526 Stack exhaustion when decoding certain messages in encoding/gob
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion...
GO-2022-0524 Stack exhaustion when reading certain archives in compress/gzip
Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion...
GO-2022-0523 Stack exhaustion when unmarshaling certain documents in encoding/xml
Unmarshaling an XML document into a Go struct which has a nested field that uses the 'any' field tag can panic due to stack exhaustion...
GO-2022-0522 Stack exhaustion on crafted paths in path/filepath
Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion...
GO-2022-0521 Stack exhaustion from deeply nested XML documents in encoding/xml
Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion...
GO-2022-0515 Stack exhaustion due to deeply nested types in go/parser
Calling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion...
GO-2022-0346 Path traversal in github.com/quay/claircore
A maliciously crafted RPM file can cause the Scanner.Scan function to write files with arbitrary contents to arbitrary locations on the local filestem...
GO-2022-0345 Environment variable leakage in github.com/containers/buildah
The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process...
GO-2022-0493 Incorrect privilege reporting in syscall and golang.org/x/sys/unix
When called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible...
GO-2022-0492 Path traversal in github.com/argoproj/argo-events
GitArtifactReader is vulnerable to directory traversal attacks. The GitArtifactReader.Read function reads and returns the contents of a Git repository file. A maliciously crafted repository can exploit this to cause Read to read from arbitrary files on the filesystem...
GO-2022-0470 No access control in github.com/blevesearch/bleve and bleve/v2
HTTP handlers provide unauthenticated access to the local filesystem. The Bleve http package is intended for demonstration purposes and contains no authentication, authorization, or validation of user inputs. Exposing handlers from this package can permit attackers to create files and delete...
GO-2022-0384 Repository credentials passed to alternate domain in helm.sh/helm/v3
The username and password credentials associated with a Helm repository can be passed to another domain referenced by that Helm repository. If the index.yaml for a Helm repository is hosted on one domain and references a chart archive on a different domain, Helm will provide the credentials for t...
GO-2022-0380 Incorrect handling of credential expiry in github.com/nats-io/jwt
The AccountClaims.IsRevoked and Export.IsRevoked functions improperly validate expired credentials using the current system time rather than the issue time of the JWT to be tested. These functions cannot be used properly. Newer versions of the jwt package provide an IsClaimRevoked method which...
GO-2022-0322 Uncontrolled resource consumption in github.com/prometheus/client_golang
The Prometheus clientgolang HTTP server is vulnerable to a denial of service attack when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of the promhttp.InstrumentHandler middleware except RequestsInFlight; not filter any specific...
GO-2022-0294 Improper input validation in github.com/google/go-attestation
A local attacker can defeat remotely-attested measured boot. Improper input validation in AKPublic.Verify can cause it to succeed when provided with a maliciously-formed Quote over no/some PCRs. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by...
GO-2022-0300 Panic via malicious inputs in github.com/graph-gophers/graphql-go
Malicious inputs can cause a panic. A maliciously crafted input can cause a stack overflow and panic. Any user with access to the GraphQL can send such a query. This issue only occurs when using the graphql.MaxDepth schema option which is highly recommended in most cases...
GO-2022-0288 Unbounded memory growth in net/http and golang.org/x/net/http2
An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests...
GO-2022-0274 Namespace restriction bypass in github.com/opencontainers/runc
An attacker with partial control over the bind mount sources of a new container can bypass namespace restrictions...
GO-2022-0272 Directory traversal in github.com/kataras/iris and github.com/kataras/iris/v12
The Context.UploadFormFiles function is vulnerable to directory traversal attacks, and can be made to write to arbitrary locations outside the destination directory. This vulnerability only occurs when built with Go versions prior to 1.17. Go 1.17 and later strip directory paths from filenames...
GO-2022-0256 Panic via maliciously crafted message in github.com/ethereum/go-ethereum
A maliciously crafted snap/1 protocol message can cause a panic...
GO-2022-0254 Consensus flaw during block processing in github.com/ethereum/go-ethereum
A vulnerability in the Geth EVM can cause a node to reject the canonical chain. A memory-corruption bug within the EVM can cause a consensus error, where vulnerable nodes obtain a different stateRoot when processing a maliciously crafted transaction. This, in turn, would lead to the chain being...
GO-2022-0253 Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki
The HTTPFetcher.GetXML function reads a response of unlimited size into memory, permitting resource exhaustion...
GO-2022-0252 Panic on misconfigured IP address in github.com/cloudflare/cfrpki
OctoRPKI crashes when a repository returns an ROA with a IP address that contains too many bits...
GO-2022-0251 Panic on NUL character in ROA in github.com/cloudflare/cfrpki
OctoRPKI crashes when a repository returns an invalid ROA that is only an encoded NUL character \0...
GO-2022-0248 Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki
Manifest path extraction is vulnerable to directory traversal attacks. The ExtractPathManifest function permits file paths containing relative directory components "..", permitting files to reference arbitrary locations on the filesystem...
GO-2022-0246 Insufficient validation in github.com/cloudflare/cfrpki
The ROAEntry.Validate function fails to perform bounds checks on the MaxLength field, allowing invalid values to pass validation...
GO-2022-0244 Insufficient randomness in UUIDs in github.com/satori/go.uuid
Random data used to create UUIDs can contain zeros, resulting in predictable UUIDs and possible collisions...
GO-2022-0236 Panic due to large headers in net/http and golang.org/x/net/http/httpguts
A malicious HTTP server or client can cause the net/http client or server to panic. ReadRequest and ReadResponse can hit an unrecoverable panic when reading a very large header over 7MB on 64-bit architectures, or over 4MB on 32-bit ones. Transport and Client are vulnerable and the program can be...
GO-2022-0191 Denial of service in chain verification in crypto/x509
The crypto/x509 package does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients verifying certificates are affected...
GO-2022-0229 Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte
On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte can lead to a panic. The malformed certificate can be delivered via a crypto/tls connection to a client, or to a server that accepts client certificates. net/http clients can...
GO-2022-0193 Panic on unconsidered isindex and template combination in golang.org/x/net/html
The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input ""...
GO-2022-0233 Resource exhaustion in github.com/pires/go-proxyproto
The PROXY protocol server does not impose a timeout on reading the header from new connections, allowing a malicious client to cause resource exhaustion and a denial of service by opening many connections and sending no data on them. v0.6.0 of the proxyproto package adds support for a user-define...
GO-2022-0230 Improper limitation of path name in github.com/containernetworking/cni
The FindInPath function is vulnerable to directory traversal attacks, potentially permitting attackers to execute arbitrary binaries. This function does not sanitize its plugin parameter, so parameter names containing "../" or other such elements may reference arbitrary locations on the filesyste...
GO-2022-0211 Incorrect parsing validation in net/url
The url.Parse function accepts URLs with malformed hosts, such that the Host field can have arbitrary suffixes that appear in neither Hostname nor Port, allowing authorization bypasses in certain applications...
GO-2022-0209 Insufficiently random values in golang.org/x/crypto/salsa20
XORKeyStream generates incorrect and insecure output for very large inputs. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream...
GO-2022-0197 Panic when parsing certain inputs in golang.org/x/net/html
The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input ""...
GO-2022-0192 Incorrect parsing of nested templates in golang.org/x/net/html
The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input ""...
GO-2022-0386 Import token permissions checking not enforced in github.com/nats-io/jwt
Import tokens valid for one account may be used for any other account. Validation of Import token bindings incorrectly warns on mismatches, rather than rejecting the Goken. This permits a token for one account to be used for any other account...
GO-2022-0187 Incorrect computation for P-256 curves in crypto/elliptic
The ScalarMult implementation of curve P-256 for amd64 architectures generates incorrect results for certain specific input points. An adaptive attack can progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to derive correct output. This leads ...
GO-2021-0142 Unbounded read from invalid inputs in encoding/binary
ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs. Certain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input...