4632 matches found
GO-2022-0385
The AuthenticateMethod authentication hook is not called for WebSocket connections, allowing unauthenticated access. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable...
GO-2022-0391 Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...
GO-2022-0400 Race condition in github.com/ntbosscher/gobase
A race condition can cause incorrect HTTP request routing...
GO-2022-0402 Panic in NATS JWT decoding in github.com/nats-io/jwt
A malicious account can create and sign a User JWT which causes a panic when decoded by the NATS JWT library...
GO-2022-0409
An attacker can create an XML file which completely bypasses signature validation, passing off an altered file as a signed one...
GO-2022-0411 Insufficient randomness in github.com/Masterminds/goutils
Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by...
GO-2022-0414 Command injection in github.com/Masterminds/vcs
Passing untrusted inputs to VCS functions can permit an attacker to execute arbitrary commands. The vcs package executes version control commands with user-provided arguments. These arguments can be interpreted as command-line flags, which can be used to perform command injection...
GO-2022-0417 Incorrect default permissions in github.com/containers/buildah
Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve2. This bug does not affect the container security sandbox, as the inheritable set never contains mo...
GO-2022-0422 Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb
The dag-pb codec can panic when decoding invalid blocks...
GO-2022-0438 Exposure of sensitive information via log file in github.com/hashicorp/go-getter
The getter package can write SSH credentials to its logfile, exposing credentials to local users able to read the logfile...
GO-2022-0444 Version rollback attack in github.com/theupdateframework/go-tuf
The TUF client is vulnerable to rollback attacks, in which an attacker causes a client to install software older than the software the client previously knew to be available...
GO-2022-0460 Infinite loop in github.com/pion/dtls/v2
An attacker can send packets that send the DTLS server or client into an infinite loop...
GO-2022-0461 Unbounded memory consumption in github.com/pion/dtls/v2
Attacker can cause unbounded memory consumption. The Pion DTLS client and server buffer handshake data with no upper limit, permitting an attacker to cause unbounded memory consumption by sending an unterminated handshake...
GO-2022-0462 Improper validation of client certificates in github.com/pion/dtls/v2
Client-provided certificates are not correctly validated, and must not be trusted. DTLS client certificates must be accompanied by proof that the client possesses the private key for the certificate. The Pion DTLS server accepted client certificates unaccompanied by this proof, permitting an...
GO-2022-0463 Access control bypass due to broad route matching in github.com/beego/beego and beego/v2
Routes in the beego HTTP router can match unintended patterns. This overly-broad matching may permit an attacker to bypass access controls. For example, the pattern "/a/b/:name" can match the URL "/a.xml/b/". This may bypass access control applied to the prefix "/a/"...
GO-2022-0574 Denial of service in github.com/open-policy-agent/opa
An issue in the AST parser of Open Policy Agent makes it possible for attackers to cause a Denial of Service attack from a crafted input...
GO-2022-0477 Indefinite hang with large buffers on Windows in crypto/rand
On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 32 - 1 bytes...
GO-2022-0586 Resource exhaustion in github.com/hashicorp/go-getter and related modules
Malicious HTTP responses can cause a number of misbehaviors, including overwriting local files, resource exhaustion, and panics. Protocol switching, endless redirect, and configuration bypass are possible through abuse of custom HTTP response header processing. Arbitrary host access is possible...
GO-2021-0154 Man-in-the-middle attack with SessionTicketsDisabled in crypto/tls
When SessionTicketsDisabled is enabled, crypto/tls allowed man-in-the-middle attackers to spoof clients via unspecified vectors. If the server enables TLS client authentication using certificates this is rare and explicitly sets SessionTicketsDisabled to true in the tls.Config, then a malicious...
GO-2022-0220 DLL injection on Windows in runtime and syscall
Go on Windows misused certain LoadLibrary functionality, leading to DLL injection...
GO-2022-0166 Denial of service due to unchecked parameters in crypto/dsa
The Verify function in crypto/dsa passed certain parameters unchecked to the underlying big integer library, possibly leading to extremely long-running computations, which in turn makes Go programs vulnerable to remote denial of service attacks. Programs using HTTPS client certificates or the Go...
GO-2022-0171 Mishandled trust preferences for root certificates on Darwin in crypto/x509
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...
GO-2022-0247 Buffer overflow in WASM modules in misc/wasm and cmd/link
When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments due to a buffer overflow error. If using wasmexec.js to execute WASM modules, users will need to replace their...
GO-2022-0213 Panic on invalid DSA public keys in crypto/dsa
Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don't chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server tha...
GO-2022-0217 Denial of service affecting P-521 and P-384 curves in crypto/elliptic
A DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU. These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some...
GO-2022-0212 Request smuggling due to accepting invalid headers in net/http via net/textproto
net/http through net/textproto used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the...
GO-2021-0347 Stack exhaustion when compiling deeply nested expressions in regexp
On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB...
GO-2021-0317 Uncontrolled memory consumption in math/big
Rat.SetString had an overflow issue that can lead to uncontrolled memory consumption...
GO-2021-0319 Incorrect computation for some invalid field elements in crypto/elliptic
Some big.Int values that are not valid field elements negative or overflowing might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values...
GO-2022-0434 Panic during certificate parsing on Darwin in crypto/x509
Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS. These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash...
GO-2022-0435 Panic due to large inputs affecting P-256 curves in crypto/elliptic
A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or P256.ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected...
GO-2022-0433 Stack overflow from a large amount of PEM data in encoding/pem
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
GO-2022-0587 Out of bounds memory access in github.com/open-policy-agent/opa
An issue in ast.Parser in Open Policy Agent causes the application to incorrectly interpret expressions, allowing a Denial of Service DoS via triggering out-of-range memory access...
GO-2022-0273 Panic due to crafted inputs in archive/zip
The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. This is caused by an incomplete fix for CVE-2021-33196...
GO-2022-0289 Misdirected I/O in syscall
When a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec including indirectly by using the os/exec package, syscall.ForkExec can close file descriptor 0 as it fails. If this happens or can be provoked repeatedly, it can result in misdirected I/O such as...
GO-2021-0412 Incorrect authorization in github.com/containerd/imgcrypt
The imgcrypt library provides API extensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function CheckAuthorization is supposed to check whether the current used is...
GO-2021-0356 Denial of service via crafted Signer in golang.org/x/crypto/ssh
Attackers can cause a crash in SSH servers when the server has been configured by passing a Signer to ServerConfig.AddHostKey such that 1 the Signer passed to AddHostKey does not implement AlgorithmSigner, and 2 the Signer passed to AddHostKey returns a key of type “ssh-rsa” from its PublicKey...
GO-2021-0321
An attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification...
GO-2021-0143
When a Handler does not explicitly set the Content-Type header, the net/http/cgi and net/http/fcgi packages default to "text/html", which can cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response...
GO-2021-0223 Certificate verification error on Windows in crypto/x509
On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in VerifyOptions.KeyUsages. This may allow a certificate to be used for an unintended purpose...
GO-2021-0224 Data race and crash in net/http
HTTP servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected...
GO-2021-0227 Panic on crafted authentication request message in golang.org/x/crypto/ssh
Clients can cause a panic in SSH servers. An attacker can craft an authentication request message for the “gssapi-with-mic” method which will cause NewServerConn to panic via a nil pointer dereference if ServerConfig.GSSAPIWithMICConfig is nil...
GO-2021-0234 Infinite loop when decoding inputs in encoding/xml
The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when operating on a custom xml.TokenReader which returns an EOF in the middle of an open XML element...
GO-2021-0235 Incorrect operations on the P-224 curve in crypto/elliptic
The P224 Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult...
GO-2021-0238 Infinite loop when parsing inputs in golang.org/x/net/html
An attacker can craft an input to ParseFragment that causes it to enter an infinite loop and never return...
GO-2021-0239 Improper sanitization when resolving values from DNS in net
The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for...
GO-2021-0240 Panic when reading certain archives in archive/zip
NewReader and OpenReader can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size...
GO-2021-0241 Attacker can drop certain headers in net/http/httputil
ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the ReverseProxy is itself a reverse proxy, this lets an attacker drop arbitrary headers, including those set by the ReverseProxy.Director...
GO-2021-0242 Panic on inputs with large exponents in math/big
Rat.SetString and Rat.UnmarshalText may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents...
GO-2021-0243 Panic on certain certificates in crypto/tls
crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected...