4632 matches found
GO-2020-0038 Improper authentication in github.com/pion/dtls
Due to improper verification of packets, unencrypted packets containing application data are accepted after the initial handshake. This allows an attacker to inject arbitrary data which the client/server believes was encrypted, despite not knowing the session key...
GO-2021-0069 Panic during division of very large numbers in math/big
A number of math/big.Int methods can panic when provided large inputs due to a flawed division method...
GO-2021-0082 Denial of service via malicious message size declaration in github.com/facebook/fbthrift
Thrift Servers preallocate memory for the declared size of messages before checking the actual size of the message. This allows a malicious user to send messages that declare that they are significantly larger than they actually are, allowing them to force the server to allocate significant amoun...
GO-2021-0097 Panic due to out-of-bounds read in github.com/dhowden/tag
Due to improper bounds checking, a number of methods can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack...
GO-2020-0007 Improper input validation in github.com/seccomp/libseccomp-golang
Filters containing rules with multiple syscall arguments are improperly constructed, such that all arguments are required to match rather than any of the arguments AND is used rather than OR. These filters can be bypassed by only specifying a subset of the arguments due to this behavior...
GO-2020-0039 Open redirect in gopkg.in/macaron.v1
Due to improper request sanitization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks...
GO-2020-0011
When decrypting JsonWebEncryption objects with multiple recipients or JsonWebSignature objects with multiple signatures the Decrypt and Verify methods do not indicate which recipient or signature was valid. This may lead a caller to rely on protected headers from an invalid recipient or signature...
GO-2020-0036 Excessive resource consumption in YAML parsing in gopkg.in/yaml.v2
Due to unbounded aliasing, a crafted YAML file can cause consumption of significant system resources. If parsing user supplied input, this may be used as a denial of service vector...
GO-2021-0051 Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2021-0077 Authentication bypass in go.etcd.io/etcd
A user can use a valid client certificate that contains a CommonName that matches a valid RBAC username to authenticate themselves as that user, despite lacking the required credentials. This may allow authentication bypass, but requires a certificate that is issued by a CA trusted by the server...
GO-2021-0057 Panic due to improper input validation in github.com/buger/jsonparser
Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector...
GO-2021-0083 Improper certificate validation in github.com/hybridgroup/gobot
TLS certificate verification is skipped when connecting to a MQTT server. This allows an attacker who can MITM the connection to read, or forge, messages passed between the client and server...
GO-2021-0098 Arbitrary code execution on Windows in github.com/git-lfs/git-lfs
Due to the standard library behavior of exec.LookPath on Windows a number of methods may result in arbitrary code execution when cloning or operating on untrusted Git repositories...
GO-2020-0010 Elliptic curve key disclosure in github.com/square/go-jose
When using ECDH-ES an attacker can mount an invalid curve attack during decryption as the supplied public key is not checked to be on the same curve as the receivers private key...
GO-2021-0095 Sensitive information exposure in github.com/google/go-tpm
Due to repeated usage of a XOR key an attacker that can eavesdrop on the TPM 1.2 transport is able to calculate usageAuth for keys created using CreateWrapKey, despite it being encrypted, allowing them to use the created key...
GO-2021-0052 Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin
Due to improper HTTP header sanitization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source...
GO-2021-0073 Arbitrary command execution in github.com/git-lfs/git-lfs
Arbitrary command execution can be triggered by improperly sanitized SSH URLs in LFS configuration files. This can be triggered by cloning a malicious repository...
GO-2021-0056
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...
GO-2021-0087 Race condition in github.com/opencontainers/runc
A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container...
GO-2020-0022 Out-of-bounds write in github.com/cloudflare/golz4
LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input...
GO-2020-0029
Due to improper HTTP header santization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source...
GO-2021-0085 Authorization bypass in github.com/opencontainers/runc
AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc...
GO-2020-0042 Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/sassoftware/go-rpmutils
Due to improper path sanitization, RPMs containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2020-0035 Path traversal in github.com/yi-ge/unzip
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2020-0045 Cryptographically weak random number generation in github.com/dinever/golf
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...
GO-2020-0015 Infinite loop when decoding some inputs in golang.org/x/text
An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to transform.String. If used to parse user supplied input, this may be used as a denial of service...
GO-2020-0008 Insecure generation of random numbers in github.com/miekg/dns
DNS message transaction IDs are generated using math/rand which makes them relatively predictable. This reduces the complexity of response spoofing attacks against DNS clients...
GO-2020-0027 Privilege escalation in github.com/google/fscrypt
After dropping and then elevating process privileges euid, guid, and groups are not properly restored to their original values, allowing an unprivileged user to gain membership in the root group...
GO-2021-0099 Zip slip directory exploit in github.com/deislabs/oras
Due to improper path validation, using the github.com/deislabs/oras/pkg/content.FileStore content store may result in directory traversal during archive extraction, allowing a malicious archive to write paths to arbitrary paths that the process can write to...
GO-2020-0014 Infinite loop due to improper handling of "select" tags in golang.org/x/net/html
html.Parse does not properly handle "select" tags, which can lead to an infinite loop. If parsing user supplied input, this may be used as a denial of service vector...
GO-2021-0081 Insufficiently Protected Credentials in github.com/containers/image
The HTTP client used to connect to the container registry authorization service explicitly disables TLS verification, allowing an attacker that is able to MITM the connection to steal credentials...
GO-2021-0090 Denial of service in github.com/tendermint/tendermint
Proposed commits may contain signatures for blocks not contained within the commit. Instead of skipping these signatures, they cause failure during verification. A malicious proposer can use this to force consensus failures...
GO-2021-0078 Panic when parsing malformed HTML in golang.org/x/net/html
The HTML parser does not properly handle "in frameset" insertion mode, and can be made to panic when operating on malformed HTML that contains tags. If operating on user input, this may be a vector for a denial of service attack...
GO-2020-0012 Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh
An attacker can craft an ssh-ed25519 or [email protected] public key, such that the library will panic when trying to verify a signature with it. If verifying signatures using user supplied public keys, this may be used as a denial of service vector...
GO-2021-0060 Authentication bypass in github.com/russellhaering/gosaml2
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...
GO-2021-0053 Panic due to improper input validation in github.com/gogo/protobuf
Due to improper bounds checking, maliciously crafted input to generated Unmarshal methods can cause an out-of-bounds panic. If parsing messages from untrusted parties, this may be used as a denial of service vector...
GO-2021-0094 Directory traversal in github.com/hashicorp/go-slug
Protections against directory traversal during archive extraction can be bypassed by chaining multiple symbolic links within the archive. This allows a malicious attacker to cause files to be created outside of the target directory. Additionally if the attacker is able to read extracted files the...
GO-2020-0033 Path Traversal in aahframe.work
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2020-0013 Man-in-the-middle attack in golang.org/x/crypto/ssh
By default host key verification is disabled which allows for man-in-the-middle attacks against SSH clients if ClientConfig.HostKeyCallback is not set...
GO-2021-0068 Arbitrary code injection via the go command with cgo on Windows in cmd/go
The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get on a malicious module, or any other time the code is built...
GO-2021-0091
Due to improper input validation when uploading a file, a malicious user may force the server to return arbitrary HTTP headers when the uploaded file is downloaded...
GO-2020-0001 Arbitrary log line injection in github.com/gin-gonic/gin
The default Formatter for the Logger middleware LoggerConfig.Formatter, which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path...
GO-2020-0040 Uncontrolled Resource Consumption in github.com/shiyanhui/dht
Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector...
GO-2020-0020 Improper access control in github.com/gorilla/handlers
Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy...
GO-2021-0063 Nil pointer dereference via malicious RPC message in github.com/ethereum/go-ethereum
Due to a nil pointer dereference, a maliciously crafted RPC message can cause a panic. If handling RPC messages from untrusted clients, this may be used as a denial of service vector...
GO-2020-0046 Panic due to malformed XML digital signature in github.com/russellhaering/goxmldsig
Due to a nil pointer dereference, a malformed XML Digital Signature can cause a panic during validation. If user supplied signatures are being validated, this may be used as a denial of service vector...
GO-2020-0024 Infinite loop in github.com/btcsuite/go-socks
The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow...
GO-2020-0026 Arbitrary file write via archive extraction in github.com/openshift/source-to-image
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2021-0070 Privilege escalation in github.com/opencontainers/runc
GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges...
GO-2020-0025 Path traversal in code.cloudfoundry.org/archiver
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...