Search CVE reports
61 – 70 of 94 results
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Fixed | Fixed | Fixed |
Some fixes available 5 of 7
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Not affected | Not affected | Not affected |
Some fixes available 10 of 13
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
8 affected packages
golang-1.17, golang-1.18, golang-1.7, golang-1.8, golang-1.11...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.17 | Not in release | Vulnerable | — | — |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.7 | — | — | — | — |
| golang-1.8 | — | — | — | Not affected |
| golang-1.11 | — | — | — | — |
| golang-1.15 | — | — | — | — |
| golang-1.16 | Not in release | Not in release | Fixed | Fixed |
| golang-1.13 | Not in release | Fixed | Fixed | Fixed |
Some fixes available 6 of 19
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
11 affected packages
golang-1.16, golang-1.13, golang, golang-1.18, golang-1.10...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.16 | Not in release | Not in release | Fixed | Fixed |
| golang-1.13 | Not in release | Not affected | Not affected | Not affected |
| golang | Not in release | Not in release | Not in release | Not in release |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.10 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Needs evaluation | Not in release |
| golang-1.17 | Not in release | Needs evaluation | Not in release | Not in release |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.15 | — | — | Not in release | Not in release |
Some fixes available 10 of 18
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter...
10 affected packages
golang-1.17, golang-1.18, golang-1.19, golang-1.13, golang-1.16...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.17 | — | Vulnerable | Not in release | Not in release |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.19 | Not in release | Not in release | Not in release | Not in release |
| golang-1.13 | Not in release | Fixed | Fixed | Fixed |
| golang-1.16 | Not in release | Not in release | Fixed | Fixed |
| golang-1.10 | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.14 | Not in release | Not in release | Vulnerable | Not in release |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.9 | Not in release | Not in release | Not in release | Vulnerable |
Some fixes available 10 of 18
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After...
10 affected packages
golang-1.19, golang-1.18, golang-1.17, golang-1.13, golang-1.16...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.19 | Not in release | Not in release | Not in release | Not in release |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.17 | — | Vulnerable | Not in release | Not in release |
| golang-1.13 | Not in release | Fixed | Fixed | Fixed |
| golang-1.16 | Not in release | Not in release | Fixed | Fixed |
| golang-1.10 | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.14 | Not in release | Not in release | Vulnerable | Not in release |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.9 | Not in release | Not in release | Not in release | Vulnerable |
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Fixed | Fixed | Fixed |
Some fixes available 16 of 33
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
14 affected packages
golang-1.13, golang-1.14, golang-1.16, golang-1.17, golang-1.18...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.13 | Not in release | Fixed | Fixed | Fixed |
| golang-1.14 | — | Not in release | Vulnerable | Not in release |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.17 | — | Vulnerable | Not in release | Not in release |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.6 | — | Not in release | Not in release | Not in release |
| golang-1.8 | — | Not in release | Not in release | Vulnerable |
| golang-1.9 | — | Not in release | Not in release | Vulnerable |
| golang | — | Not in release | Not in release | Not in release |
| golang-1.10 | — | Not in release | Not in release | Vulnerable |
| golang-golang-x-net | Not affected | Vulnerable | Not in release | Not in release |
| google-guest-agent | Fixed | Fixed | Fixed | Needs evaluation |
| containerd | Not affected | Not affected | Not affected | Not affected |
| golang-golang-x-net-dev | Not in release | Not in release | Needs evaluation | Needs evaluation |
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
9 affected packages
golang-1.6, golang-1.10, golang-1.13, golang-1.15, golang-1.14...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.6 | — | — | — | — |
| golang-1.10 | — | — | — | Needs evaluation |
| golang-1.13 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.15 | — | — | — | — |
| golang-1.14 | — | — | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Needs evaluation | — | — |
| golang-1.8 | — | — | — | Needs evaluation |
| golang-1.9 | — | — | — | Needs evaluation |
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
10 affected packages
golang-1.13, golang, golang-1.10, golang-1.14, golang-1.15...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.13 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | Not in release |
| golang-1.10 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Needs evaluation | Not in release |
| golang-1.15 | — | — | Not in release | Not in release |
| golang-1.16 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Needs evaluation | Not in release | Not in release |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Needs evaluation |