4764 matches found
GO-2021-0068 Arbitrary code injection via the go command with cgo on Windows in cmd/go
The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get on a malicious module, or any other time the code is built...
GO-2020-0048 Denial of service in github.com/antchfx/xmlquery
LoadURL does not check the Content-Type of loaded resources, which can cause a panic due to nil pointer deference if the loaded resource is not XML. If user supplied URLs are loaded, this may be used as a denial of service vector...
GO-2020-0041 Path Traversal in github.com/unknwon/cae
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2020-0010 Elliptic curve key disclosure in github.com/square/go-jose
When using ECDH-ES an attacker can mount an invalid curve attack during decryption as the supplied public key is not checked to be on the same curve as the receivers private key...
GO-2020-0038 Improper authentication in github.com/pion/dtls
Due to improper verification of packets, unencrypted packets containing application data are accepted after the initial handshake. This allows an attacker to inject arbitrary data which the client/server believes was encrypted, despite not knowing the session key...
GO-2021-0088 Denial of service via ignored unknown fields in github.com/facebook/fbthrift
Skip ignores unknown fields, rather than failing. A malicious user can craft small messages with unknown fields which can take significant resources to parse. If a server accepts messages from an untrusted user, it may be used as a denial of service vector...
GO-2020-0031
Due to improper setting of finalizers, memory passed to C may be freed before it is used, leading to crashes due to memory corruption or possible code execution...
GO-2021-0073 Arbitrary command execution in github.com/git-lfs/git-lfs
Arbitrary command execution can be triggered by improperly sanitized SSH URLs in LFS configuration files. This can be triggered by cloning a malicious repository...
GO-2020-0040 Uncontrolled Resource Consumption in github.com/shiyanhui/dht
Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector...
GO-2020-0009 Integer overflow in github.com/square/go-jose
On 32-bit platforms an attacker can manipulate a ciphertext encrypted with AES-CBC with HMAC such that they can control how large the input buffer is when computing the HMAC authentication tag. This can can allow a manipulated ciphertext to be verified as authentic, opening the door for padding...
GO-2020-0050 XML digital signature validation bypass in github.com/russellhaering/goxmldsig
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...
GO-2021-0065 Unauthorized credential disclosure in k8s.io/kubernetes and k8s.io/client-go
Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level...
GO-2021-0066 Sensitive information leak via log file in k8s.io/kubernetes
Attempting to read a malformed .dockercfg may cause secrets to be inappropriately logged...
GO-2020-0035 Path traversal in github.com/yi-ge/unzip
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2020-0043 Authentication bypass in github.com/mholt/caddy
Due to improper TLS verification when serving traffic for multiple SNIs, an attacker may bypass TLS client authentication by indicating an SNI during the TLS handshake that is different from the name in the HTTP Host header...
GO-2020-0025 Path traversal in code.cloudfoundry.org/archiver
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2021-0081 Insufficiently Protected Credentials in github.com/containers/image
The HTTP client used to connect to the container registry authorization service explicitly disables TLS verification, allowing an attacker that is able to MITM the connection to steal credentials...
GO-2021-0072 Uncontrolled resource allocation in github.com/docker/distribution
Various storage methods do not impose limits on how much content is accepted from user requests, allowing a malicious user to force the caller to allocate an arbitrary amount of memory...
GO-2020-0001 Arbitrary log line injection in github.com/gin-gonic/gin
The default Formatter for the Logger middleware LoggerConfig.Formatter, which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path...
GO-2020-0013 Man-in-the-middle attack in golang.org/x/crypto/ssh
By default host key verification is disabled which allows for man-in-the-middle attacks against SSH clients if ClientConfig.HostKeyCallback is not set...
GO-2020-0004 Authentication bypass in github.com/nanobox-io/golang-nanoauth
If any of the ListenAndServe functions are called with an empty token, token authentication is disabled globally for all listeners. Also, a minor timing side channel was present allowing attackers with very low latency and able to make many requests to potentially recover the token...
GO-2020-0014 Infinite loop due to improper handling of "select" tags in golang.org/x/net/html
html.Parse does not properly handle "select" tags, which can lead to an infinite loop. If parsing user supplied input, this may be used as a denial of service vector...
GO-2020-0045 Cryptographically weak random number generation in github.com/dinever/golf
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...
GO-2020-0033 Path Traversal in aahframe.work
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2020-0028 Denial of service via malformed zone file in github.com/miekg/dns
Due to a nil pointer dereference, parsing a malformed zone file containing TA records may cause a panic. If parsing user supplied input, this may be used as a denial of service vector...
GO-2020-0049 Improper input validation in github.com/justinas/nosurf
Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid...
GO-2021-0067 Panic when opening archives in archive/zip
Using Reader.Open on an archive containing a file with a path prefixed by "../" will cause a panic due to a stack overflow. If parsing user supplied archives, this may be used as a denial of service vector...
GO-2021-0058 Signature validation bypass due to XML processing error in github.com/crewjam/saml
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...
GO-2021-0071 Race condition in github.com/lxc/lxd
A race between chown and chmod operations during a container filesystem shift may allow a user who can modify the filesystem to chmod an arbitrary path of their choice, rather than the expected path...
GO-2021-0094 Directory traversal in github.com/hashicorp/go-slug
Protections against directory traversal during archive extraction can be bypassed by chaining multiple symbolic links within the archive. This allows a malicious attacker to cause files to be created outside of the target directory. Additionally if the attacker is able to read extracted files the...
GO-2021-0052 Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin
Due to improper HTTP header sanitization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source...
GO-2020-0021 SQL Injection in github.com/gogits/gogs
Due to improper sanitization of user input, a number of methods are vulnerable to SQL injection if used with user input that has not been sanitized by the caller...
GO-2021-0053 Panic due to improper input validation in github.com/gogo/protobuf
Due to improper bounds checking, maliciously crafted input to generated Unmarshal methods can cause an out-of-bounds panic. If parsing messages from untrusted parties, this may be used as a denial of service vector...
GO-2020-0007 Improper input validation in github.com/seccomp/libseccomp-golang
Filters containing rules with multiple syscall arguments are improperly constructed, such that all arguments are required to match rather than any of the arguments AND is used rather than OR. These filters can be bypassed by only specifying a subset of the arguments due to this behavior...
GO-2020-0027 Privilege escalation in github.com/google/fscrypt
After dropping and then elevating process privileges euid, guid, and groups are not properly restored to their original values, allowing an unprivileged user to gain membership in the root group...
GO-2020-0047 Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...
GO-2020-0024 Infinite loop in github.com/btcsuite/go-socks
The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow...
GO-2020-0036 Excessive resource consumption in YAML parsing in gopkg.in/yaml.v2
Due to unbounded aliasing, a crafted YAML file can cause consumption of significant system resources. If parsing user supplied input, this may be used as a denial of service vector...
GO-2020-0032 Path traversal in github.com/goadesign/goa
Due to improper sanitization of user input, Controller.FileHandler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2021-0064 Unauthorized credential disclosure via debug logs in k8s.io/kubernetes and k8s.io/client-go
Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level. This is due to an incomplete fix for CVE-2019-11250...
GO-2020-0005 Panic due to malformed WALs in go.etcd.io/etcd
Malformed WALs can be constructed such that WAL.ReadAll can cause attempted out of bounds reads, or creation of arbitrarily sized slices, which may be used as a DoS vector...
GO-2020-0003 Resource exhaustion in github.com/revel/revel
An attacker can cause an application that accepts slice parameters https://revel.github.io/manual/parameters.htmlslices to allocate large amounts of memory and crash through manipulating the request query sent to the application...
GO-2020-0006 Denial of service via open idle connection in github.com/miekg/dns
An attacker may prevent TCP connections to a Server by opening a connection and leaving it idle, until the connection is closed by the server no other connections will be accepted...
GO-2020-0008 Insecure generation of random numbers in github.com/miekg/dns
DNS message transaction IDs are generated using math/rand which makes them relatively predictable. This reduces the complexity of response spoofing attacks against DNS clients...
GO-2020-0018
UUIDs generated using NewV1 and NewV4 may not read the expected number of random bytes. These UUIDs may contain a significantly smaller amount of entropy than expected, possibly leading to collisions...
GO-2020-0046 Panic due to malformed XML digital signature in github.com/russellhaering/goxmldsig
Due to a nil pointer dereference, a malformed XML Digital Signature can cause a panic during validation. If user supplied signatures are being validated, this may be used as a denial of service vector...
GO-2021-0051 Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2021-0057 Panic due to improper input validation in github.com/buger/jsonparser
Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector...
GO-2021-0070 Privilege escalation in github.com/opencontainers/runc
GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges...
GO-2021-0076 Out-of-bounds write in github.com/evanphx/json-patch
A malicious JSON patch can cause a panic due to an out-of-bounds write attempt. This can be used as a denial of service vector if exposed to arbitrary user input...