4632 matches found
GO-2023-2163 Curve KeyPairs fail to encrypt in github.com/nats-io/nkeys
Curve KeyPairs always use the same all-zeros key to encrypt data, and provide no security...
GO-2023-2160 Panic during QUIC handshake in github.com/quic-go/quic-go
The QUIC handshake can cause a panic when processing a certain sequence of frames. A malicious peer can deliberately trigger this panic...
GO-2023-2017 Denial of service vulnerability in github.com/weaviate/weaviate
A type conversion issue in Weaviate may allow a remote attack that would cause a denial of service...
GO-2023-2153 Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc
An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of...
GO-2023-2046 Unbounded memory consumption in github.com/ethereum/go-ethereum
Unbounded memory consumption in github.com/ethereum/go-ethereum...
GO-2023-2119 Proof forgery due to insufficient randomness in github.com/consensys/gnark
A a third party may derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. This vulnerability is due to randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of...
GO-2023-2137 Credentials leak in github.com/ydb-platform/ydb-go-sdk/v3
A custom credentials object that does not implement the fmt.Stringer interface may leak sensitive information e.g., credentials via logs...
GO-2023-2133 Authorization bypass in github.com/nats-io/nats-server/v2
Without any authorization rules in the nats-server, users can connect without authentication. Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an "authorization" block, defining users. With nats-server 2.2.0 all users live inside accounts. When using...
GO-2023-2116 CSRF token validation vulnerability in github.com/gofiber/fiber/v2
A cross-site request forgery vulnerability can allow an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is...
GO-2023-2115 CSRF token reuse vulnerability in github.com/gofiber/fiber/v2
A cross-site request forgery vulnerability in this package can allow an attacker to inject arbitrary values and forge malicious requests on behalf of a user. The attacker may inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated use...
GO-2023-2114 Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml
The package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting XSS in the IdP context durin...
GO-2023-2113 Memory exhaustion in go.opentelemetry.io/contrib/instrumentation
Memory exhaustion in go.opentelemetry.io/contrib/instrumentation...
GO-2023-2102 HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
GO-2023-2101 Incorrect exponentiation results in github.com/consensys/gnark-crypto
Incorrect exponentiation results in github.com/consensys/gnark-crypto...
GO-2023-2098 Unsoundness in variable comparison / non-unique binary decomposition in github.com/consensys/gnark
Unsoundness in variable comparison / non-unique binary decomposition in github.com/consensys/gnark...
GO-2023-2095 Arbitrary code execution during build via line directives in cmd/go
Line directives "//line" can be used to bypass the restrictions on "//go:cgo" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of...
GO-2023-2096 Signature malleability in github.com/consensys/gnark-crypto
Signature malleability in github.com/consensys/gnark-crypto...
GO-2023-2077 Authentication bypass in github.com/sagernet/sing
Authentication bypass in github.com/sagernet/sing...
GO-2023-2074 Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown
Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown...
GO-2023-2048 Paths outside of the rootfs could be produced on Windows in github.com/cyphar/filepath-securejoin
Certain rootfs and path combinations result in generated paths that are outside of the provided rootfs on Windows...
GO-2023-2024 Out-of-memory vulnerability in github.com/libp2p/go-libp2p
A malicious actor can store an arbitrary amount of data in the memory of a remote node by sending the node a message with a signed peer record. Signed peer records from randomly generated peers can be sent by a malicious actor. This memory does not get garbage collected and so the remote node can...
GO-2023-2052 IsFromLocal local address check can be circumvented in github.com/gofiber/fiber/v2
The Ctx.IsFromLocal function can incorrectly report a request as being sent from localhost when the request contains an X-Forwarded-For header containing a localhost IP address...
GO-2023-2044 Panic when processing post-handshake message on QUIC connections in crypto/tls
Processing an incomplete post-handshake message for a QUIC connection can cause a panic...
GO-2023-2045 Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
GO-2023-2043 Improper handling of special tags within script contexts in html/template
The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack...
GO-2023-2042 Arbitrary code execution via go.mod toolchain directive in cmd/go
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules...
GO-2023-2041 Improper handling of HTML-like comments in script contexts in html/template
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS atta...
GO-2023-1998 Improper path sanitization in sandbox mode in github.com/projectdiscovery/nuclei/v2
Improper path sanitization in sandbox mode in github.com/projectdiscovery/nuclei/v2...
GO-2023-1992 Misleading message verification in golang.org/x/crypto/openpgp/clearsign
The clearsign package accepts some malformed messages, making it possible for an attacker to trick a human user but not a Go program into thinking unverified text is part of the message. With fix, messages with malformed headers in the SIGNED MESSAGE section are rejected...
GO-2023-1664 Denial of service via deflate compression bomb in github.com/crewjam/saml
Denial of service via deflate compression bomb in github.com/crewjam/saml...
GO-2023-1640 Path traversal when unzipping files in github.com/dablelv/go-huge-util
Path traversal when unzipping files in github.com/dablelv/go-huge-util...
GO-2023-2003 Group signature validation bypass in github.com/supranational/blst
When complemented with a check for infinity, blst skips performing a signature group-check. Formally speaking, infinity is the identity element of the elliptic curve group and as such it is a member of the group, so the group-check should be performed. The fix performs the check even in the...
GO-2023-2000 Large RSA keys can cause high resource usage in github.com/libp2p/go-libp2p
Large RSA keys can lead to resource exhaustion attacks. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits...
GO-2023-1987 Large RSA keys can cause high CPU usage in crypto/tls
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...
GO-2023-1988 Improper rendering of text nodes in golang.org/x/net/html
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...
GO-2023-1990 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size width height appearing to be zero...
GO-2023-1989 Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image both in terms of pixel width/height, and encoded size to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU...
GO-2023-1941 Panic when handling invalid request in MITM mode in github.com/elazarl/goproxy
An invalid request can cause a panic when running in MITM mode...
GO-2023-1930 Unrestricted memory consumption in github.com/hamba/avro
Unrestricted memory consumption in github.com/hamba/avro...
GO-2023-1923 Panic when handling invalid HAProxy PROXY v2 request in github.com/mastercactapus/proxyprotocol
Panic when handling invalid HAProxy PROXY v2 request in github.com/mastercactapus/proxyprotocol...
GO-2023-1914 Brute-force of token secrets in github.com/superfly/tokenizer
Brute-force of token secrets in github.com/superfly/tokenizer...
GO-2023-1883 Denial of service via OOM in github.com/cometbft/cometbft
A bug in the CometBFT middleware causes the mempool's two data structures to fall out of sync. This can lead to duplicate transactions that cannot be removed, even after they are committed in a block. The only way to remove the transaction is to restart the node. This can be exploited by an...
GO-2023-1878 Insufficient sanitization of Host header in net/http
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...
GO-2023-1857 Panic when parsing ranges with invalid masks in github.com/malfunkt/iprange
Parsing a range with a mask larger than 32 bits causes a panic...
GO-2023-1733 Timing attack from non-constant time scalar arithmetic in github.com/bnb-chain/tss-lib
Timing attack from non-constant time scalar arithmetic in github.com/bnb-chain/tss-lib...
GO-2023-1904 Collision of hash values in github.com/bnb-chain/tss-lib
Collision of hash values in github.com/bnb-chain/tss-lib...
GO-2023-1867 Replay attacks involving proofs in github.com/bnb-chain/tss-lib
Replay attacks involving proofs in github.com/bnb-chain/tss-lib...
GO-2023-1732 Timing attack from non-constant time scalar multiplication in github.com/bnb-chain/tss-lib
Timing attack from non-constant time scalar multiplication in github.com/bnb-chain/tss-lib...
GO-2023-1589 Denial of service from memory exhaustion in github.com/notaryproject/notation-go
Parsing PKIX distinguished names containing the string "=" can cause excessive memory consumption...
GO-2023-1882 Deadlock in github.com/cometbft/cometbft/consensus
An internal modification to the way PeerState is serialized to JSON introduced a deadlock when the new function MarshalJSON is called. This function can be called in two ways. The first is via logs, by setting the consensus logging module to "debug" level which should not happen in production, an...