USN-7109-1: Go vulnerabilities

🗓️ 14 Nov 2024 13:57:58Reported by UbuntuType

ubuntu

ubuntu🔗 ubuntu.com👁 36 Views

Go vulnerabilities allow denial of service and arbitrary code execution through various methods.

Reporter	Title	Published	Views	Family All 12691
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling was built with a vulnerable golang compiler. ( CVE-2023-29406, CVE-2023-29409 )	6 Dec 202315:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	1 Dec 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-41724)	27 Jul 202317:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and the IntegrationServer and IntegrationRuntime operands are vulnerable to networking errors [CVE-2024-24790]	23 Aug 202409:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to glibc, Golang Go , Apache HTTP, IBM GSKit-Crypto and GnuTLS packages/liberaries .	22 May 202409:19	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties affects IBM Watson Machine Learning Accelerator 3.5.0 for Cloud Pak for Data 4.6.5	8 Feb 202419:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Golang Go, HTTP/2, NGINX, OpenSSH, Linux kernel might affect IBM Spectrum Protect Plus	4 Feb 202518:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Golang Go security bypass vulnerabilitiy( CVE-2024-24785)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from go-yaml, OpenSSL, GnuTLS , OpenTelemetry-Go, go-toolset and urllib3	30 Jan 202408:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to multiple ansible-operator and opm vulnerabilities	20 Feb 202419:29	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	22.04	amd64	golang-1.18	1.18.1-1ubuntu1.2	golang-1.18_1.18.1-1ubuntu1.2_amd64.deb
Ubuntu	22.04	arm64	golang-1.18	1.18.1-1ubuntu1.2	golang-1.18_1.18.1-1ubuntu1.2_arm64.deb
Ubuntu	22.04	armhf	golang-1.18	1.18.1-1ubuntu1.2	golang-1.18_1.18.1-1ubuntu1.2_armhf.deb
Ubuntu	22.04	i386	golang-1.18	1.18.1-1ubuntu1.2	golang-1.18_1.18.1-1ubuntu1.2_i386.deb
Ubuntu	22.04	ppc64el	golang-1.18	1.18.1-1ubuntu1.2	golang-1.18_1.18.1-1ubuntu1.2_ppc64el.deb
Ubuntu	22.04	riscv64	golang-1.18	1.18.1-1ubuntu1.2	golang-1.18_1.18.1-1ubuntu1.2_riscv64.deb
Ubuntu	22.04	s390x	golang-1.18	1.18.1-1ubuntu1.2	golang-1.18_1.18.1-1ubuntu1.2_s390x.deb
Ubuntu	16.04	any	golang-1.18	1.18.1-1ubuntu1~16.04.6+esm1	golang-1.18_1.18.1-1ubuntu1~16.04.6+esm1_any.deb
Ubuntu	18.04	any	golang-1.18	1.18.1-1ubuntu1~18.04.4+esm1	golang-1.18_1.18.1-1ubuntu1~18.04.4+esm1_any.deb
Ubuntu	20.04	amd64	golang-1.18	1.18.1-1ubuntu1~20.04.3	golang-1.18_1.18.1-1ubuntu1~20.04.3_amd64.deb

14 Nov 2024 13:57Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

EPSS0.91969

SSVC

go vulnerabilities denial of service arbitrary code execution http/2 streams memory management readform validation environment variable sanitization multipart forms special characters permission bits compiler directives.