Package Search Help

You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.

Search by package name:
my-package (implicit)
name:my-package (explicit)

Search by package filename:
filename:my-package.ext 

Search by package tag:
tag:latest 

Search by package version:
version:1.0.0  prerelease:true (prereleases)
prerelease:false (no prereleases)

Search by package architecture:
architecture:x86_64 

Search by package distribution:
distribution:el 

Search by package license:
license:MIT 

Search by package format:
format:deb 

Search by package status:
status:in_progress 

Search by package file checksum:
checksum:5afba 

Search by package security status:
severity:critical 

Search by package vulnerabilities:
vulnerabilities:>1 
vulnerabilities:<1000 

Search by # of package downloads:
downloads:>8 
downloads:<100 

Search by package type:
type:binary 
type:source 

Search by package size (bytes):
size:>50000 
size:<10000 

Search by dependency name/version:
dependency:log4j 
dependency:log4j=1.0.0 
dependency:log4j>1.0.0 

Search by uploaded date:
uploaded:>"1 day ago" 
uploaded:<"August 14, 2022 EST" 

Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY 

Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true

Search by repository:
repository:repo-name

Search by last download date:
last_downloaded:<"30 days ago" 
last_downloaded:>"August 14, 2022 EST" 

Search queries for all Debian-specific (and related) package types

Search by component:
deb_component:unstable

Search queries for all Maven-specific (and related) package types

Search by group ID:
maven_group_id:org.apache

Search queries for all Docker-specific (and related) package types

Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)

Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)

Search queries for all Generic-specific package types

Search by file path:
generic_filepath:path/to/file.txt

Search by directory:
generic_directory:path/to

Field type modifiers (depending on the type, you can influence behaviour)

For all queries, you can use:
~foo for negation

For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching

For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal

Need a secure and centralised artifact repository to deliver Alpine, Cargo, CocoaPods, Composer, Conan, Conda, CRAN, Dart, Debian, Docker, Generic, Go, Helm, Hex, HuggingFace, LuaRocks, Maven, MCP, npm, NuGet, P2, Python, RedHat, Ruby, Swift, Terraform, Vagrant, VSX, Raw & More packages?

Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.

With support for all major package formats, you can trust us to manage your software supply chain.

Start My Free Trial
Set Me Up
 Public — demo-docs demo-docs / awesome-repo
A certifiably-awesome public package repository curated by demo-docs, hosted by Cloudsmith.
Packages 19189 Package Groups 1676 Public Keys
Package Policy Violations

This package is in violation of the following policy.

Medium severity CVEs:
  • A security scan detected a vulnerability with a severity which is not permitted by this policy.

Docker logo library/mariadb  781d5c901f78c9e5c87d2530b6a…

Download

One-liner (summary)

A certifiably-awesome package curated by Cloudsmith, hosted by Cloudsmith.

Description

A certifiably-awesome package curated by Cloudsmith, hosted by Cloudsmith.

License

Unknown

Size

100.3 MB

Downloads

0

Tags

image amd64 linux upstream dockerhub SBOMcheck high_sev_less_than_… high-sev

Status  Quarantined
Checksum (MD5) 4f64b1d63afa300a9528ed3219723bf4
Checksum (SHA-1) 4c09d0f11f87c34682872894f6a98ff5fbf93db2
Checksum (SHA-256) 781d5c901f78c9e5c87d2530b6a1a45a7cca139252c95d948697d245da3d8f87
Checksum (SHA-512) 915b16a3496755def2525c6f854c0665f55841de7699572f4eea8202baa245ab71…
GPG Signature
Download
GPG Fingerprint 6811684bac0b8895434e97bdd4391b8fb999e537
Storage Region  Dublin, Ireland
Type  Binary (contains binaries and binary artifacts)
Uploaded At 9 months, 3 weeks ago
Uploaded By Uploaded by Cloudsmith
Slug Id librarymariadb-ehb5
Unique Id K9et6eZodQSw
Version (Raw) 781d5c901f78c9e5c87d2530b6a1a45a7cca139252c95d948697d245da3d8f87
Version (Parsed)
  • Type: Unknown
  docker-specific metadata
Image Digest sha256:781d5c901f78c9e5c87d2530b6a1a45a7cca139252c95d948697d245da3d8f87
Config Digest sha256:94956b6ebcf3e7a311d95a7cc59db4b5535b8f28324337dbb7429e6cb8d2091b
V1 OCI Index Digest sha256:d5be694bba2439b53e903825aa08212e1eca1c0eb6a7976fb247f9f4fa7862fe
V1 Distribution (Signed) Digest sha256:20e2ea7bce6995d065616d1574c7f97e4025aa2a3fbd820c5031e06e46087e98
V2 Distribution List Digest sha256:3e9431195a3996a49062042d7417a753bf7e22bac703f26324e82782be9abe09
V2 Distribution Digest sha256:cc15d67a55d61c8b590896820063065133d02e834d85d233b615b73fbccf1ffc
V1 Distribution Digest sha256:2baed3a93098087506dbf595ed086ee0c5fee02e8b82c2622d5b3348e12bf52c
V1 OCI Digest sha256:781d5c901f78c9e5c87d2530b6a1a45a7cca139252c95d948697d245da3d8f87
  extended metadata
Manifest Type V1 OCI
Architecture amd64
Config
Cmd
mariadbd
Entrypoint
docker-entrypoint.sh
Env
GOSU_VERSION=1.17 | LANG=C.UTF-8 | MARIADB_VERSION=1:11.8.2+maria~ubu2404 | PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Exposed Ports
3306/tcp
Labels
'org.opencontainers.image.documentation' 'https://hub.docker.com/_/mariadb/'
Labels
'org.opencontainers.image.licenses' 'GPL-2.0'
Labels
'org.opencontainers.image.ref.name' 'ubuntu'
Labels
'org.opencontainers.image.source' 'https://github.com/MariaDB/mariadb-docker'
Labels
'org.opencontainers.image.title' 'MariaDB Database'
Labels
'org.opencontainers.image.url' 'https://github.com/MariaDB/mariadb-docker'
Labels
'org.opencontainers.image.vendor' 'MariaDB Community'
Labels
'org.opencontainers.image.version' '11.8.2'
Labels
'org.opencontainers.image.authors' 'MariaDB Community'
Labels
'org.opencontainers.image.base.name' 'docker.io/library/ubuntu:noble'
Labels
'org.opencontainers.image.description' 'MariaDB Database for relational SQL'
Volumes
/var/lib/mysql
Created 2025-06-10 21:48:21 UTC
Os linux

This package was uploaded with the following V1 OCI manifest: 

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "digest": "sha256:0cf8160fce1a9390c242e09f549b59880f1de01c585435832fbca23993c634ac",
    "size": 8735
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:d9d352c11bbd3880007953ed6eec1cbace76898828f3434984a0ca60672fdf5a",
      "size": 29715337
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:724d2bd0d22b3848e120f00f5d4510c9348eec1cfd92caa130033131e7d0c4a8",
      "size": 1343
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:25a7db65036f979900730c019d87a1bfab436e056c6f7e3c69d7e0f37c89737c",
      "size": 5349780
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:1505691d6c89732853990cec59a3aa98d6539a4ec2467957a70abfd268ccab07",
      "size": 116
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:54629b454f33acc39fb90e590dbe9995ad940e8d23ed81794d12628b354a7aac",
      "size": 331
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:87381ff545f9489f1039ae2e5f5a117ab28a672b2bd8f2678ffc641cbde7b103",
      "size": 70131081
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:271c152ca4f4b90d88ebb4a762d17ef89a79278913af627fd9cc2b63bf55cc74",
      "size": 4038
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:48f38a8fddb6c5fc7efbfc721b3ad9bd0cb4f5d8b664d7db7aa69e768afd7246",
      "size": 8399
    }
  ],
  "annotations": {
    "com.docker.official-images.bashbrew.arch": "amd64",
    "org.opencontainers.image.base.digest": "sha256:04f510bf1f2528604dc2ff46b517dbdbb85c262d62eacc4aa4d3629783036096",
    "org.opencontainers.image.base.name": "ubuntu:noble",
    "org.opencontainers.image.created": "2025-06-10T21:48:21Z",
    "org.opencontainers.image.revision": "4c5048803b4785a1ef057c2d4c48b126a08348c6",
    "org.opencontainers.image.source": "https://github.com/MariaDB/mariadb-docker.git#4c5048803b4785a1ef057c2d4c48b126a08348c6:11.8",
    "org.opencontainers.image.url": "https://hub.docker.com/_/mariadb",
    "org.opencontainers.image.version": "11.8.2-noble"
  }
}
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ARG RELEASE
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ARG LAUNCHPAD_BUILD_ARCH
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) LABEL org.opencontainers.image.ref.name=ubuntu
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) LABEL org.opencontainers.image.version=24.04
 32 bytes
Digest: sha256:d9d352c11bbd3880007953ed6eec1cbace76898828f3434984a0ca60672fdf5a
Command: /bin/sh -c #(nop) ADD file:598ca0108009b5c2e9e6f4fc4bd19a6bcd604fccb5b9376fac14a75522a5cfa3 in /
28.3 MB
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) CMD ["/bin/bash"]
 32 bytes
Digest: sha256:724d2bd0d22b3848e120f00f5d4510c9348eec1cfd92caa130033131e7d0c4a8
Command: RUN /bin/sh -c groupadd -r mysql && useradd -r -g mysql mysql --home-dir /var/lib/mysql && userdel --remove ubuntu # buildkit
 1.3 KB
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENV GOSU_VERSION=1.17
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8
 32 bytes
Digest: sha256:25a7db65036f979900730c019d87a1bfab436e056c6f7e3c69d7e0f37c89737c
Command: RUN |1 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 /bin/sh -c set -eux; apt-get update; DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates gpg gpgv libjemalloc2 pwgen tzdata xz-utils zstd ; savedAptMark="$(apt-mark showmanual)"; apt-get install -y --no-install-recommends dirmngr gpg-agent wget; rm -rf /var/lib/apt/lists/*; dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; wget -q -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; wget -q -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; for key in $GPG_KEYS; do gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; done; gpg --batch --export "$GPG_KEYS" > /etc/apt/trusted.gpg.d/mariadb.gpg; if command -v gpgconf >/dev/null; then gpgconf --kill all; fi; gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; gpgconf --kill all; rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; apt-mark auto '.*' > /dev/null; [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark >/dev/null; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; chmod +x /usr/local/bin/gosu; gosu --version; gosu nobody true # buildkit
 5.1 MB
Digest: sha256:1505691d6c89732853990cec59a3aa98d6539a4ec2467957a70abfd268ccab07
Command: RUN |1 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 /bin/sh -c mkdir /docker-entrypoint-initdb.d # buildkit
 116 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENV LANG=C.UTF-8
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: LABEL org.opencontainers.image.authors=MariaDB Community org.opencontainers.image.title=MariaDB Database org.opencontainers.image.description=MariaDB Database for relational SQL org.opencontainers.image.documentation=https://hub.docker.com/_/mariadb/ org.opencontainers.image.base.name=docker.io/library/ubuntu:noble org.opencontainers.image.licenses=GPL-2.0 org.opencontainers.image.source=https://github.com/MariaDB/mariadb-docker org.opencontainers.image.vendor=MariaDB Community org.opencontainers.image.version=11.8.2 org.opencontainers.image.url=https://github.com/MariaDB/mariadb-docker
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG MARIADB_VERSION=1:11.8.2+maria~ubu2404
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENV MARIADB_VERSION=1:11.8.2+maria~ubu2404
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG REPOSITORY=http://archive.mariadb.org/mariadb-11.8.2/repo/ubuntu/ noble main main/debug
 32 bytes
Digest: sha256:54629b454f33acc39fb90e590dbe9995ad940e8d23ed81794d12628b354a7aac
Command: RUN |3 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 MARIADB_VERSION=1:11.8.2+maria~ubu2404 REPOSITORY=http://archive.mariadb.org/mariadb-11.8.2/repo/ubuntu/ noble main main/debug /bin/sh -c set -e; echo "deb ${REPOSITORY}" > /etc/apt/sources.list.d/mariadb.list; { echo 'Package: *'; echo 'Pin: release o=MariaDB'; echo 'Pin-Priority: 999'; } > /etc/apt/preferences.d/mariadb # buildkit
 331 bytes
Digest: sha256:87381ff545f9489f1039ae2e5f5a117ab28a672b2bd8f2678ffc641cbde7b103
Command: RUN |3 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 MARIADB_VERSION=1:11.8.2+maria~ubu2404 REPOSITORY=http://archive.mariadb.org/mariadb-11.8.2/repo/ubuntu/ noble main main/debug /bin/sh -c set -ex; { echo "mariadb-server" mysql-server/root_password password 'unused'; echo "mariadb-server" mysql-server/root_password_again password 'unused'; } | debconf-set-selections; apt-get update; mkdir -p /var/lib/mysql/mysql ; touch /var/lib/mysql/mysql/user.frm ; apt-get install -y --no-install-recommends mariadb-server="$MARIADB_VERSION" mariadb-backup socat ; rm -rf /var/lib/apt/lists/*; rm -rf /var/lib/mysql; mkdir -p /var/lib/mysql /run/mysqld; chown -R mysql:mysql /var/lib/mysql /run/mysqld; chmod 1777 /run/mysqld; find /etc/mysql/ -name '*.cnf' -print0 | xargs -0 grep -lZE '^(bind-address|log|user\s)' | xargs -rt -0 sed -Ei 's/^(bind-address|log|user\s)/#&/'; printf "[mariadb]\nhost-cache-size=0\nskip-name-resolve\n" > /etc/mysql/mariadb.conf.d/05-skipcache.cnf; if [ -L /etc/mysql/my.cnf ]; then sed -i -e '/includedir/ {N;s/\(.*\)\n\(.*\)/\n\2\n\1/}' /etc/mysql/mariadb.cnf; fi # buildkit
 66.9 MB
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: VOLUME [/var/lib/mysql]
 32 bytes
Digest: sha256:271c152ca4f4b90d88ebb4a762d17ef89a79278913af627fd9cc2b63bf55cc74
Command: COPY healthcheck.sh /usr/local/bin/healthcheck.sh # buildkit
 3.9 KB
Digest: sha256:48f38a8fddb6c5fc7efbfc721b3ad9bd0cb4f5d8b664d7db7aa69e768afd7246
Command: COPY docker-entrypoint.sh /usr/local/bin/ # buildkit
 8.2 KB
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENTRYPOINT ["docker-entrypoint.sh"]
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: EXPOSE map[3306/tcp:{}]
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: CMD ["mariadbd"]
 32 bytes

Last scanned

9 months, 3 weeks ago

Scan result

Vulnerable

Vulnerability count

85

Max. severity

Critical
Target: K9et6eZodQSw.sbom-cyclonedx.json (ubuntu 24.04)
MEDIUM

CVE-2025-29481: libbpf: Heap Buffer Overflow in libbpf

Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf_object__init_prog` function of libbpf.

Package Name: libbpf1
Installed Version: 1:1.3.0-2build2
Fixed Version:

References: access.redhat.com github.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2024-10041: pam: libpam: Libpam vulnerable to read hashed password

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

Package Name: libpam-modules
Installed Version: 1.5.3-5ubuntu5.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2024-10963: pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

Package Name: libpam-modules
Installed Version: 1.5.3-5ubuntu5.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2024-10041: pam: libpam: Libpam vulnerable to read hashed password

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

Package Name: libpam-modules-bin
Installed Version: 1.5.3-5ubuntu5.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2024-10963: pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

Package Name: libpam-modules-bin
Installed Version: 1.5.3-5ubuntu5.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2024-10041: pam: libpam: Libpam vulnerable to read hashed password

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

Package Name: libpam-runtime
Installed Version: 1.5.3-5ubuntu5.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2024-10963: pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

Package Name: libpam-runtime
Installed Version: 1.5.3-5ubuntu5.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2024-10041: pam: libpam: Libpam vulnerable to read hashed password

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

Package Name: libpam0g
Installed Version: 1.5.3-5ubuntu5.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2024-10963: pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

Package Name: libpam0g
Installed Version: 1.5.3-5ubuntu5.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2025-4598: systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Package Name: libsystemd0
Installed Version: 255.4-1ubuntu8.6
Fixed Version: 255.4-1ubuntu8.8

References: www.openwall.com www.openwall.com access.redhat.com bugzilla.redhat.com git.kernel.org github.com github.com github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com www.cve.org www.openwall.com www.qualys.com
MEDIUM

CVE-2025-4598: systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Package Name: libudev1
Installed Version: 255.4-1ubuntu8.6
Fixed Version: 255.4-1ubuntu8.8

References: www.openwall.com www.openwall.com access.redhat.com bugzilla.redhat.com git.kernel.org github.com github.com github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com www.cve.org www.openwall.com www.qualys.com
LOW

CVE-2016-2781: coreutils: Non-privileged session can escape to the parent session in chroot

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Package Name: coreutils
Installed Version: 9.4-3ubuntu6
Fixed Version:

References: seclists.org www.openwall.com www.openwall.com access.redhat.com lists.apache.org lore.kernel.org mirrors.edge.kernel.org nvd.nist.gov www.cve.org
LOW

CVE-2022-3219: gnupg: denial of service issue (resource consumption) using compressed packets

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Package Name: gpg
Installed Version: 2.4.4-2ubuntu17.2
Fixed Version:

References: access.redhat.com bugzilla.redhat.com dev.gnupg.org dev.gnupg.org marc.info nvd.nist.gov security.netapp.com www.cve.org
LOW

CVE-2022-3219: gnupg: denial of service issue (resource consumption) using compressed packets

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Package Name: gpgconf
Installed Version: 2.4.4-2ubuntu17.2
Fixed Version:

References: access.redhat.com bugzilla.redhat.com dev.gnupg.org dev.gnupg.org marc.info nvd.nist.gov security.netapp.com www.cve.org
LOW

CVE-2022-3219: gnupg: denial of service issue (resource consumption) using compressed packets

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Package Name: gpgv
Installed Version: 2.4.4-2ubuntu17.2
Fixed Version:

References: access.redhat.com bugzilla.redhat.com dev.gnupg.org dev.gnupg.org marc.info nvd.nist.gov security.netapp.com www.cve.org
LOW

CVE-2016-20013

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

Package Name: libc-bin
Installed Version: 2.39-0ubuntu8.4
Fixed Version:

References: akkadia.org pthree.org twitter.com www.cve.org
LOW

CVE-2016-20013

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

Package Name: libc6
Installed Version: 2.39-0ubuntu8.4
Fixed Version:

References: akkadia.org pthree.org twitter.com www.cve.org
LOW

CVE-2025-1352: elfutils: GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.

Package Name: libelf1t64
Installed Version: 0.190-1.1ubuntu0.1
Fixed Version:

References: access.redhat.com nvd.nist.gov sourceware.org sourceware.org sourceware.org vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org
LOW

CVE-2025-1376: elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service

A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.

Package Name: libelf1t64
Installed Version: 0.190-1.1ubuntu0.1
Fixed Version:

References: access.redhat.com nvd.nist.gov sourceware.org sourceware.org sourceware.org vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org
LOW

CVE-2024-2236: libgcrypt: vulnerable to Marvin Attack

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Package Name: libgcrypt20
Installed Version: 1.10.3-2build1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com dev.gnupg.org errata.almalinux.org github.com gitlab.com linux.oracle.com linux.oracle.com lists.gnupg.org nvd.nist.gov www.cve.org
LOW

CVE-2024-41996: openssl: remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.

Package Name: libssl3t64
Installed Version: 3.0.13-0ubuntu3.5
Fixed Version:

References: access.redhat.com dheatattack.gitlab.io dheatattack.gitlab.io gist.github.com github.com github.com nvd.nist.gov openssl-library.org www.cve.org
LOW

CVE-2024-56433: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Package Name: login
Installed Version: 1:4.13+dfsg1-4ubuntu3.2
Fixed Version:

References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org
LOW

CVE-2024-41996: openssl: remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.

Package Name: openssl
Installed Version: 3.0.13-0ubuntu3.5
Fixed Version:

References: access.redhat.com dheatattack.gitlab.io dheatattack.gitlab.io gist.github.com github.com github.com nvd.nist.gov openssl-library.org www.cve.org
LOW

CVE-2024-56433: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Package Name: passwd
Installed Version: 1:4.13+dfsg1-4ubuntu3.2
Fixed Version:

References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org
Target: usr/local/bin/gosu
CRITICAL

CVE-2023-24538: golang: html/template: backticks not treated as string delimiters

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.8, 1.20.3

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
CRITICAL

CVE-2023-24540: golang: html/template: improper handling of JavaScript whitespace

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.9, 1.20.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com www.cve.org
CRITICAL

CVE-2024-24790: golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.11, 1.22.4

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-27664: golang: net/http: handle server errors after sending GOAWAY

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.18.6, 1.19.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cs.opensource.google cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com groups.google.com groups.google.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-28131: golang: encoding/xml: stack exhaustion in Decoder.Skip

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-2879: golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.18.7, 1.19.2

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-2880: golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.18.7, 1.19.2

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-29804: ELSA-2022-17957: ol8addon security update (IMPORTANT)

Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.11, 1.18.3

References: go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev
HIGH

CVE-2022-30580: golang: os/exec: Code injection in Cmd.Start

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.11, 1.18.3

References: access.redhat.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org
HIGH

CVE-2022-30630: golang: io/fs: stack exhaustion in Glob

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-30631: golang: compress/gzip: stack exhaustion in Reader.Read

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-30632: golang: path/filepath: stack exhaustion in Glob

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-30633: golang: encoding/xml: stack exhaustion in Unmarshal

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-30634: ELSA-2022-17957: ol8addon security update (IMPORTANT)

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.11, 1.18.3

References: go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev
HIGH

CVE-2022-30635: golang: encoding/gob: stack exhaustion in Decoder.Decode

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-32189: golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.13, 1.18.5

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-41715: golang: regexp/syntax: limit memory used by parsing regexps

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.18.7, 1.19.2

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org ubuntu.com www.cve.org
HIGH

CVE-2022-41716: Due to unsanitized NUL values, attackers may be able to maliciously se ...

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.18.8, 1.19.3

References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com
HIGH

CVE-2022-41720: golang: os, net/http: avoid escapes from os.DirFS and http.Dir on Windows

On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.18.9, 1.19.4

References: access.redhat.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org
HIGH

CVE-2022-41722: golang: path/filepath: path-filepath filepath.Clean path traversal

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.6, 1.20.1

References: access.redhat.com go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev www.cve.org
HIGH

CVE-2022-41723: golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.6, 1.20.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com go.dev go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com vuln.go.dev www.couchbase.com www.couchbase.com www.cve.org
HIGH

CVE-2022-41724: golang: crypto/tls: large handshake records may cause panics

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.6, 1.20.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org ubuntu.com ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2022-41725: golang: net/http, mime/multipart: denial of service from excessive resource consumption

A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.6, 1.20.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org ubuntu.com ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2023-24534: golang: net/http, net/textproto: denial of service from excessive memory allocation

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.8, 1.20.3

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2023-24536: golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.8, 1.20.3

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com go.dev go.dev go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2023-24537: golang: go/parser: Infinite loop in parsing

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.8, 1.20.3

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2023-24539: golang: html/template: improper sanitization of CSS values

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.9, 1.20.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com www.cve.org
HIGH

CVE-2023-29400: golang: html/template: improper handling of empty HTML attributes

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.9, 1.20.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com www.cve.org
HIGH

CVE-2023-29403: golang: runtime: unexpected behavior of setuid/setgid binaries

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.10, 1.20.5

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com www.cve.org
HIGH

CVE-2023-39325: golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.20.10, 1.21.3

References: None access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cisa.gov www.cve.org
HIGH

CVE-2023-45283: The filepath package does not recognize paths with a \??\ prefix as sp ...

The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.20.11, 1.21.4, 1.20.12, 1.21.5

References: www.openwall.com go.dev go.dev go.dev go.dev groups.google.com groups.google.com nvd.nist.gov pkg.go.dev security.netapp.com
HIGH

CVE-2023-45287: golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.20.0

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov people.redhat.com pkg.go.dev security.netapp.com www.cve.org
HIGH

CVE-2023-45288: golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.9, 1.22.2

References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org go.dev go.dev groups.google.com kb.cert.org linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org nowotarski.info nowotarski.info nvd.nist.gov pkg.go.dev security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.kb.cert.org
HIGH

CVE-2024-34156: encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.22.7, 1.23.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2022-1705: golang: net/http: improper sanitization of Transfer-Encoding header

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2022-1962: golang: go/parser: stack exhaustion in all Parse* functions

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com www.cve.org
MEDIUM

CVE-2022-32148: golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.12, 1.18.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com go.dev go.dev go.googlesource.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2022-41717: golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.18.9, 1.19.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cs.opensource.google errata.almalinux.org github.com github.com go.dev go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2023-24532: golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.7, 1.20.2

References: access.redhat.com go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev security.netapp.com www.cve.org
MEDIUM

CVE-2023-29406: golang: net/http: insufficient sanitization of Host header

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.11, 1.20.6

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2023-29409: golang: crypto/tls: slow verification of certificate chains containing large RSA keys

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.19.12, 1.20.7, 1.21.0-rc.4

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com www.cve.org
MEDIUM

CVE-2023-39318: golang: html/template: improper handling of HTML-like comments within script contexts

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.20.8, 1.21.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com ubuntu.com vuln.go.dev www.cve.org
MEDIUM

CVE-2023-39319: golang: html/template: improper handling of special tags within script contexts

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.20.8, 1.21.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.gentoo.org security.netapp.com ubuntu.com ubuntu.com ubuntu.com vuln.go.dev www.cve.org
MEDIUM

CVE-2023-39326: golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.20.12, 1.21.5

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com lists.fedoraproject.org nvd.nist.gov pkg.go.dev ubuntu.com www.cve.org
MEDIUM

CVE-2023-45284: On Windows, The IsLocal function does not correctly detect reserved de ...

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.20.11, 1.21.4

References: go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev
MEDIUM

CVE-2023-45289: golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.8, 1.22.1

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com www.cve.org
MEDIUM

CVE-2023-45290: golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.8, 1.22.1

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2024-24783: golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.8, 1.22.1

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2024-24784: golang: net/mail: comments in display names are incorrectly handled

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.8, 1.22.1

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2024-24785: golang: html/template: errors returned from MarshalJSON methods may break template escaping

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.8, 1.22.1

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com ubuntu.com ubuntu.com vuln.go.dev www.cve.org
MEDIUM

CVE-2024-24789: golang: archive/zip: Incorrect handling of certain ZIP files

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.11, 1.22.4

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com lists.fedoraproject.org nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2024-24791: net/http: Denial of service due to improper 100-continue handling in net/http

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.21.12, 1.22.5

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2024-34155: go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.22.7, 1.23.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2024-34158: go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.22.7, 1.23.1

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com go.dev go.dev groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org
MEDIUM

CVE-2024-45336: golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.22.11, 1.23.5, 1.24.0-rc.2

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org go.dev go.dev groups.google.com groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com www.cve.org
MEDIUM

CVE-2024-45341: golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.22.11, 1.23.5, 1.24.0-rc.2

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org go.dev go.dev groups.google.com groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev security.netapp.com www.cve.org
MEDIUM

CVE-2025-0913: Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.23.10, 1.24.4

References: go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev
MEDIUM

CVE-2025-22866: crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.22.12, 1.23.6, 1.24.0-rc.3

References: access.redhat.com github.com github.com github.com github.com go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev security.netapp.com www.cve.org
MEDIUM

CVE-2025-22871: net/http: Request smuggling due to acceptance of invalid chunked data in net/http

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.23.8, 1.24.2

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com errata.almalinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org
MEDIUM

CVE-2025-4673: Proxy-Authorization and Proxy-Authenticate headers persisted on cross- ...

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.23.10, 1.24.4

References: go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev www.cve.org
LOW

CVE-2022-30629: golang: crypto/tls: session tickets lack random ticket_age_add

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

Package Name: stdlib
Installed Version: v1.18.2
Fixed Version: 1.17.11, 1.18.3

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com go.dev go.dev go.googlesource.com groups.google.com groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com ubuntu.com www.cve.org
Previous Version: 1cf5f5345eeecb1aea2…
Next Version: ea19247a5a6cb891b81…
Top