Browse CVEs

HIGH 7.5 CVE-2021-43565 The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. Ssh 0.0.0-20211202192323-5770296d904e+ Fix from $1,9502022-09-06 HIGH 7.5 CVE-2022-32189 A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing … Go 1.17.13 / 1.18.5+ Fix from $1,9502022-08-10 MEDIUM 6.5 CVE-2022-32148 Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with… Go 1.17.12 / 1.18.4+ Fix from $1,6002022-08-10 HIGH 7.5 CVE-2022-30633 Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via u… Go 1.17.12 / 1.18.4+ Fix from $1,9502022-08-10 HIGH 7.5 CVE-2022-30635 Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion … Go 1.17.12 / 1.18.4+ Fix from $1,9502022-08-10 HIGH 7.5 CVE-2022-30631 Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion vi… Go 1.17.12 / 1.18.4+ Fix from $1,9502022-08-10 HIGH 7.5 CVE-2022-30632 Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a pat… Go 1.17.12 / 1.18.4+ Fix from $1,9502022-08-10 HIGH 7.8 CVE-2022-30580 Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com"… Go 1.17.11 / 1.18.3+ Fix from $1,9502022-08-10 HIGH 7.5 CVE-2022-30630 Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which … Go 1.17.12 / 1.18.4+ Fix from $1,9502022-08-10 HIGH 7.5 CVE-2022-29804 Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows po… Go 1.17.11 / 1.18.3+ Fix from $1,9502022-08-10 HIGH 7.5 CVE-2022-28131 Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion vi… Go 1.17.12 / 1.18.4+ Fix from $1,9502022-08-10 MEDIUM 5.5 CVE-2022-1962 Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion… Go 1.17.12 / 1.18.4+ Fix from $1,6002022-08-10 MEDIUM 6.5 CVE-2022-1705 Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling i… Go 1.17.12 / 1.18.4+ Fix from $1,6002022-08-10 HIGH 7.5 CVE-2022-30634 Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer large… Go 1.17.11 / 1.18.3+ Fix from $1,9502022-07-15 MEDIUM 5.3 CVE-2022-29526 Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function co… Go 1.17.10 / 1.18.2+ Fix from $1,6002022-06-23 HIGH 7.5 CVE-2022-28327 The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. Go 1.17.9 / 1.18.1+ Fix from $1,9502022-04-20 HIGH 7.5 CVE-2022-24675EPSS 10% encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. Go 1.17.9 / 1.18.1+ Fix from $1,9502022-04-20 HIGH 7.5 CVE-2022-27536 Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This… Go 1.18.1+ Fix from $1,9502022-04-20 HIGH 7.5 CVE-2022-27191 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances inv… Ssh 0.0.0-20220314234659-1baeb1ce4c0b+ Fix from $1,9502022-03-18 HIGH 7.5 CVE-2022-24921 regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. Go 1.16.15 / 1.17.8+ Fix from $1,9502022-03-05 CRITICAL 9.1 CVE-2022-23806 Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that … Go 1.16.14 / 1.17.7+ Fix from $2,3002022-02-11 HIGH 7.5 CVE-2022-23772 Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. Go 1.16.14 / 1.17.7+ Fix from $1,9502022-02-11 HIGH 7.5 CVE-2022-23773 cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect… Go 1.16.14 / 1.17.7+ Fix from $1,9502022-02-11 HIGH 7.5 CVE-2021-39293EPSS 7% In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a N… Go 1.16.8 / 1.17.1+ Fix from $1,9502022-01-24 HIGH 7.5 CVE-2021-44716 net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 request… Go 1.16.12 / 1.17.5+ Fix from $1,9502022-01-01 HIGH 7.5 CVE-2021-41771 ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buff… Go 1.16.10 / 1.17.3+ Fix from $1,9502021-11-08 HIGH 7.5 CVE-2021-41772 Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty f… Go 1.16.10 / 1.17.3+ Fix from $1,9502021-11-08 CRITICAL 9.8 CVE-2021-38297EPSS 11% Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOO… Go 1.16.9 / 1.17.2+ Fix from $2,3002021-10-18 MEDIUM 5.9 CVE-2021-36221 Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. Go 1.15.15 / 1.16.7+ Fix from $1,6002021-08-08 HIGH 7.5 CVE-2021-29923 Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attac… Go 1.17 / 21.1.1.1.0+ Fix from $1,9502021-08-07