Browse CVEs

HIGH 8.1 CVE-2020-0601 KEVEPSS 89% A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could… Go 1.12.16 / 1.13.7+ Fix from $1,9502020-01-14 HIGH 7.5 CVE-2019-17596 Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are severa… Go 1.12.11 / 1.13.2+ Fix from $1,9502019-10-24 HIGH 7.5 CVE-2019-16276EPSS 5% Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. Go 1.12.10 / 1.13.1+ Fix from $1,9502019-09-30 CRITICAL 9.8 CVE-2019-14809EPSS 8% net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. Th… Go 1.11.13 / 1.12.8+ Fix from $2,3002019-08-13 MEDIUM 5.9 CVE-2019-11841 A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to t… Crypto No fix yet Fix from $1,6002019-05-22 CRITICAL 9.8 CVE-2019-11888 Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain… Go after 1.12.5 Fix from $2,3002019-05-13 MEDIUM 5.9 CVE-2019-11840 An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was foun… Crypto Patch available Fix from $1,6002019-05-09 MEDIUM 6.1 CVE-2019-9741 An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second … Go Patch available Fix from $1,6002019-03-13 HIGH 7.8 CVE-2019-9634 Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Go 1.11.10 / 1.12.2+ Fix from $1,9502019-03-08 HIGH 8.2 CVE-2019-6486 Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consum… Go 1.10.8 / 1.11.5+ Fix from $1,9502019-01-24 HIGH 8.1 CVE-2018-16873EPSS 66% In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the impo… Go 1.10.6 / 1.11.3+ Fix from $1,9502018-12-14 HIGH 8.1 CVE-2018-16874EPSS 5% In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malic… Go 1.10.6 / 1.11.3+ Fix from $1,9502018-12-14 HIGH 7.5 CVE-2018-16875EPSS 6% The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which m… Go 1.10.6 / 1.11.3+ Fix from $1,9502018-12-14 HIGH 7.5 CVE-2018-17846 The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during a… Net after 2018-09-25 Fix from $1,9502018-10-01 HIGH 7.5 CVE-2018-17847 The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (… Net after 2018-09-25 Fix from $1,9502018-10-01 HIGH 7.5 CVE-2018-17848 The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index … Net after 2018-09-25 Fix from $1,9502018-10-01 HIGH 7.5 CVE-2018-17142 The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCur… Net after 2018-09-17 Fix from $1,9502018-09-17 HIGH 7.5 CVE-2018-17143 The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inB… Net after 2018-09-17 Fix from $1,9502018-09-17 HIGH 7.5 CVE-2018-17075 The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse… Net after 2018-07-12 Fix from $1,9502018-09-16 HIGH 8.8 CVE-2018-7187EPSS 63% The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks fo… Go 1.9.5 / 1.10.1+ Fix from $1,9502018-02-16 HIGH 7.8 CVE-2018-6574EPSS 8% Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, … Go after 1.8.6 Fix from $1,9502018-02-07 CRITICAL 9.8 CVE-2015-5739EPSS 10% The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct… Go after 1.4.2 Fix from $2,3002017-10-18 CRITICAL 9.8 CVE-2015-5740 The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP r… Go after 1.4.2 Fix from $2,3002017-10-18 CRITICAL 9.8 CVE-2017-15041EPSS 9% Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that examp… Go after 1.8.3 Fix from $2,3002017-10-05 MEDIUM 5.9 CVE-2017-15042 An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only … Go after 1.8.3 Fix from $1,6002017-10-05 HIGH 7.5 CVE-2017-1000097 On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was expl… Go 1.6.4 / 1.7.4+ Fix from $1,9502017-10-05 HIGH 7.5 CVE-2017-1000098 The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory"… Go 1.6.4 / 1.7.4+ Fix from $1,9502017-10-05 MEDIUM 5.9 CVE-2017-8932 A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incor… Go after 1.7.5 Fix from $1,6002017-07-06 HIGH 8.1 CVE-2017-3204 The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4… Crypto after 2017-03-17 Fix from $1,9502017-04-04 HIGH 7.5 CVE-2016-3959 The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer libra… Go after 1.5 Fix from $1,9502016-05-23