Browse CVEs

HIGH 7.5 CVE-2021-33196 In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. Go 1.15.13 / 1.16.5+ Fix from $1,9502021-08-02 HIGH 7.5 CVE-2021-33198 In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. Go 1.15.13 / 1.16.5+ Fix from $1,9502021-08-02 HIGH 7.3 CVE-2021-33195 Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may c… Go 1.15.13 / 1.16.5+ Fix from $1,9502021-08-02 MEDIUM 5.3 CVE-2021-33197 In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker i… Go 1.15.13 / 1.16.5+ Fix from $1,6002021-08-02 MEDIUM 6.5 CVE-2021-34558EPSS 7% The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type wh… Go 1.15.14 / 1.16.6+ Fix from $1,6002021-07-15 CRITICAL 9.8 CVE-2012-2666 golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name a… Go Patch available Fix from $2,3002021-07-09 MEDIUM 5.9 CVE-2021-31525 net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest… Go 1.15.12 / 1.16.4+ Fix from $1,6002021-05-27 HIGH 7.5 CVE-2021-33194EPSS 7% golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment in… Go after 1.16.4 Fix from $1,9502021-05-26 HIGH 7.5 CVE-2021-27918 encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the m… Go 1.15.9 / 1.16.1+ Fix from $1,9502021-03-11 MEDIUM 5.5 CVE-2021-27919 archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP arch… Go 1.16.1+ Fix from $1,6002021-03-11 HIGH 7.5 CVE-2021-3115EPSS 6% Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to… Go 1.14.14 / 1.15.7+ Fix from $1,9502021-01-26 MEDIUM 6.5 CVE-2021-3114 In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb dur… Go 1.14.14 / 1.15.7+ Fix from $1,6002021-01-26 HIGH 8.6 CVE-2021-3121 An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" i… Protobuf 1.3.2 / 1.8.15+ Fix from $1,9502021-01-11 HIGH 7.5 CVE-2020-28852 In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/lang… Text 0.3.5+ Fix from $1,9502021-01-02 HIGH 7.5 CVE-2020-28851 In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is sup… Go No fix yet Fix from $1,9502021-01-02 HIGH 7.5 CVE-2020-29652 A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause… Ssh after 0.0.0-20201203163018-be400aefbc4c Fix from $1,9502020-12-17 MEDIUM 5.6 CVE-2020-29509 The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-tri… Go 1.17+ Fix from $1,6002020-12-14 MEDIUM 5.6 CVE-2020-29510 The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, whi… Go after 1.15 Fix from $1,6002020-12-14 MEDIUM 5.6 CVE-2020-29511 The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips… Go 1.17+ Fix from $1,6002020-12-14 HIGH 7.5 CVE-2020-28367 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags speci… Go 1.14.12 / 1.15.5+ Fix from $1,9502020-11-18 HIGH 7.5 CVE-2020-28362 Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. Go 1.14.12 / 1.15.5+ Fix from $1,9502020-11-18 HIGH 7.5 CVE-2020-28366 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symb… Go 1.14.12 / 1.15.5+ Fix from $1,9502020-11-18 MEDIUM 6.1 CVE-2020-24553 Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. Go 1.14.8 / 1.15.1+ Fix from $1,6002020-09-02 HIGH 7.5 CVE-2020-16845 Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs. Go 1.13.15 / 1.14.7+ Fix from $1,9502020-08-06 MEDIUM 5.9 CVE-2020-15586 Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it… Go 0.203.0 / 1.13.13+ Fix from $1,6002020-07-17 MEDIUM 5.3 CVE-2020-14039 In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.… Go 1.13.13 / 1.14.5+ Fix from $1,6002020-07-17 HIGH 7.5 CVE-2020-14040 The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causi… Text 0.3.3+ Fix from $1,9502020-06-17 HIGH 7.5 CVE-2020-7919 Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clie… Go 1.12.6 / 1.13.7+ Fix from $1,9502020-03-16 HIGH 7.5 CVE-2020-9283EPSS 21% golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh pack… Package Ssh No fix yet Fix from $1,9502020-02-20 CRITICAL 9.8 CVE-2015-5741 The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP r… Go 1.4.3+ Fix from $2,3002020-02-08