4632 matches found
GO-2021-0245 Panic in ReverseProxy in net/http/httputil
ReverseProxy can panic after encountering a problem copying a proxied response body...
GO-2021-0172 Denial of service when parsing large forms in mime/multipart
When parsing large multipart/form-data, an attacker can cause a HTTP server to open a large number of file descriptors. This may be used as a denial-of-service vector...
GO-2022-0425 Weak encryption and denial of service in github.com/flynn/noise
The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 18.4 quintillion messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to b...
GO-2022-0701 Directory traversal in k8s.io/kubernetes
Crafted object type names can cause directory traversal in Kubernetes. Object names are not validated before being passed to etcd. This allows attackers to write arbitrary files via a crafted object name, hence causing directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift...
GO-2022-0643 Denial of service in github.com/elastic/beats
A local attacker can cause a panic if they are able to send arbitrary traffic to a monitored port, due to an out of bounds read...
GO-2022-0629 Directory traversal in sigs.k8s.io/secrets-store-csi-driver
Modifying pod status allows host directory traversal. Kubernetes Secrets Store CSI Driver allows an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under...
GO-2022-0646 CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...
GO-2022-0563 Cross-site request forgery in github.com/filebrowser/filebrowser/v2
A Cross-Site Request Forgery vulnerability exists in Filebrowser that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim...
GO-2021-0258 Incorrect authorization in github.com/pomerium/pomerium
Pomerium is an open source identity-aware access proxy. Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make incorrect authorizati...
GO-2021-0228 Path traversal in github.com/unknwon/cae
The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...
GO-2021-0264 Panic when opening certain archives in archive/zip
Previously, opening a zip with Reader.Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or ".." path elements. Open could also panic if passed the empty string directly as an argument. Now, any files in the zip whose name could not be...
GO-2021-0263 Panic on invalid symbol tables in debug/macho
Calling File.ImportedSymbols on a loaded file which contains an invalid dynamic symbol table command can cause a panic, in particular if the encoded number of undefined symbols is larger than the number of symbols in the symbol table...
GO-2021-0226 Cross-site scripting in net/http/cgi and net/http/fcgi
When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response. The Content-Type header is now set based on the contents of the...
GO-2021-0225
Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This could lead to processing more input than expected when the caller is reading directly from a network and depends on...
GO-2021-0237 Open redirect in github.com/AndrewBurian/powermux
Attackers may be able to craft phishing links and other open redirects by exploiting PowerMux's trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link...
GO-2021-0178 Cleartext transmission of credentials in net/smtp
SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured with TLS, exposing passwords to man-in-the-middle SMTP servers...
GO-2021-0163 Privilege escalation on Windows via malicious DLL in syscall
Untrusted search path vulnerability on Windows related to LoadLibrary allows local users to gain privileges via a malicious DLL in the current working directory...
GO-2021-0159 Request smuggling due to improper header parsing in net/http
HTTP headers were not properly parsed, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields...
GO-2021-0157
The MIME header parser treated spaces and hyphens as equivalent, which can permit HTTP request smuggling...
GO-2021-0160 Incorrect calculation affecting RSA computations in math/big
Int.Exp Montgomery mishandled carry propagation and produced an incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors. This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibl...
GO-2021-0141
A Go HTTP server which reads from the request body while simultaneously writing a response can panic when clients send a "Expect: 100-continue" header...
GO-2021-0140
X509 Certificate verification does not validate KeyUsages EKU requirements on Windows if VerifyOptions.Roots is nil...
GO-2021-0113 Out-of-bounds read in golang.org/x/text/language
Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...
GO-2021-0111
Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are affected if they use this package to handle untrusted user input...
GO-2021-0102 Panic in decryption in code.cloudfoundry.org/gorouter
Due to improper input validation, a maliciously crafted input can cause a panic, due to incorrect nonce size. If this package is used to decrypt user supplied messages without checking the size of supplied nonces, this may be used as a vector for a denial of service attack...
GO-2021-0106 Path traversal in github.com/whyrusleeping/tar-utils
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2021-0109 Improper handling of token revocation in github.com/ory/fosite
Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage...
GO-2021-0105 Consensus flaw in github.com/ethereum/go-ethereum
Due to an incorrect state calculation, a specific set of transactions could cause a consensus disagreement, causing users of this package to reject a canonical chain...
GO-2021-0110 Token reuse in github.com/ory/fosite
Uniqueness of JWT IDs jti are not checked, allowing the JWT to be replayed...
GO-2021-0107 Panic or authentication bypass in github.com/ecnepsnai/web
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...
GO-2021-0101 Panic due to out-of-bounds read in github.com/apache/thrift
Due to an improper bounds check, parsing maliciously crafted messages can cause panics. If this package is used to parse untrusted input, this may be used as a vector for a denial of service attack...
GO-2021-0104 Authorization bypass in github.com/pion/webrtc/v3
Due to improper error handling, DTLS connections were not killed when certificate verification failed, causing users who did not check the connection state to continue to use the connection. This could allow allow an attacker which holds the ICE password, but not a valid certificate, to bypass th...
GO-2021-0112 Improper input validation in go.mongodb.org/mongo-driver
Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are affected if they use this package to handle untrusted user input...
GO-2021-0108 CRLF vulnerability in Fiber in github.com/gofiber/fiber
Due to improper input sanitization, a maliciously constructed filename could cause a file download to use an attacker controlled filename, as well as injecting additional headers into an HTTP response...
GO-2021-0103 Denial of service in github.com/holiman/uint256
Due to improper bounds checking, certain mathematical operations can cause a panic via an out of bounds read. If this package is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...
GO-2021-0100 Denial of service via deadlock in github.com/containers/storage
Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an...
GO-2022-0762 Cross-site scripting due to incorrect sanitization in github.com/microcosm-cc/bluemonday
An XSS injection was possible because the sanitization of the Cyrillic character i bypass a protection mechanism against user-inputted HTML elements such as the tag...
GO-2022-0706 Information disclosure in go.elastic.co/apm
Sensitive HTTP headers may not be properly sanitized before being sent to the APM server if the program panics...
GO-2022-0755 Cross-site request forgery in github.com/rancher/rancher
Rancher 2 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher...
GO-2022-0621 Exposure of sensitive information in k8s.io/kube-state-metrics
Exposing annotations as metrics can leak secrets. An experimental feature of kube-state-metrics enables annotations to be exposed as metrics. By default, metrics only expose metadata about secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire...
GO-2020-0037 Uncontrolled resource consumption in github.com/tendermint/tendermint
Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector...
GO-2021-0075 Panic due to improper validation of RPC messages in github.com/ethereum/go-ethereum
Due to improper argument validation in RPC messages, a maliciously crafted message can cause a panic, leading to denial of service...
GO-2020-0028 Denial of service via malformed zone file in github.com/miekg/dns
Due to a nil pointer dereference, parsing a malformed zone file containing TA records may cause a panic. If parsing user supplied input, this may be used as a denial of service vector...
GO-2020-0049 Improper input validation in github.com/justinas/nosurf
Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid...
GO-2021-0079 Panic in github.com/bytom/bytom
A malformed query can cause an out-of-bounds panic due to improper validation of arguments. If processing queries from untrusted parties, this may be used as a vector for denial of service attacks...
GO-2021-0084 Incorrect permissions for critical resource in github.com/astaxie/beego
Session data is stored using permissive permissions, allowing local users with filesystem access to read arbitrary data...
GO-2021-0089 Infinite loop in github.com/buger/jsonparser
Parsing malformed JSON which contain opening brackets, but not closing brackets, leads to an infinite loop. If operating on untrusted user input this can be used as a denial of service vector...
GO-2020-0050 XML digital signature validation bypass in github.com/russellhaering/goxmldsig
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...
GO-2020-0010 Elliptic curve key disclosure in github.com/square/go-jose
When using ECDH-ES an attacker can mount an invalid curve attack during decryption as the supplied public key is not checked to be on the same curve as the receivers private key...
GO-2021-0073 Arbitrary command execution in github.com/git-lfs/git-lfs
Arbitrary command execution can be triggered by improperly sanitized SSH URLs in LFS configuration files. This can be triggered by cloning a malicious repository...