Search CVE reports
131 – 140 of 142 results
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
3 affected packages
golang-1.16, golang-1.13, golang-1.18
| Package | 20.04 LTS |
|---|---|
| golang-1.16 | Fixed |
| golang-1.13 | Not affected |
| golang-1.18 | Fixed |
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
8 affected packages
golang-1.16, golang-1.13, golang-1.11, golang-1.15, golang-1.17...
| Package | 20.04 LTS |
|---|---|
| golang-1.16 | Fixed |
| golang-1.13 | Fixed |
| golang-1.11 | — |
| golang-1.15 | — |
| golang-1.17 | — |
| golang-1.18 | Fixed |
| golang-1.7 | — |
| golang-1.8 | — |
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when...
6 affected packages
golang-1.11, golang-1.15, golang-1.17, golang-1.18, golang-1.7, golang-1.8
| Package | 20.04 LTS |
|---|---|
| golang-1.11 | — |
| golang-1.15 | — |
| golang-1.17 | — |
| golang-1.18 | Not affected |
| golang-1.7 | — |
| golang-1.8 | — |
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
6 affected packages
golang-1.11, golang-1.15, golang-1.17, golang-1.18, golang-1.7, golang-1.8
| Package | 20.04 LTS |
|---|---|
| golang-1.11 | — |
| golang-1.15 | — |
| golang-1.17 | — |
| golang-1.18 | Not affected |
| golang-1.7 | — |
| golang-1.8 | — |
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
3 affected packages
golang-1.16, golang-1.13, golang-1.18
| Package | 20.04 LTS |
|---|---|
| golang-1.16 | Fixed |
| golang-1.13 | Fixed |
| golang-1.18 | Fixed |
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.
1 affected package
golang-1.18
| Package | 20.04 LTS |
|---|---|
| golang-1.18 | Fixed |
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the...
3 affected packages
golang-1.16, golang-1.13, golang-1.18
| Package | 20.04 LTS |
|---|---|
| golang-1.16 | Fixed |
| golang-1.13 | Fixed |
| golang-1.18 | Fixed |
Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
6 affected packages
golang-1.11, golang-1.15, golang-1.17, golang-1.18, golang-1.7, golang-1.8
| Package | 20.04 LTS |
|---|---|
| golang-1.11 | — |
| golang-1.15 | — |
| golang-1.17 | — |
| golang-1.18 | Not affected |
| golang-1.7 | — |
| golang-1.8 | — |
Some fixes available 2 of 3
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
11 affected packages
golang-1.16, golang-1.17, golang, golang-1.10, golang-1.13...
| Package | 20.04 LTS |
|---|---|
| golang-1.16 | Fixed |
| golang-1.17 | Not in release |
| golang | Not in release |
| golang-1.10 | Not in release |
| golang-1.13 | Not affected |
| golang-1.14 | Needs evaluation |
| golang-1.15 | Not in release |
| golang-1.18 | Fixed |
| golang-1.6 | Not in release |
| golang-1.8 | Not in release |
| golang-1.9 | Not in release |
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
2 affected packages
golang-1.18, golang-1.17
| Package | 20.04 LTS |
|---|---|
| golang-1.18 | Fixed |
| golang-1.17 | — |