Search CVE reports
51 – 60 of 76 results
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files...
10 affected packages
golang, golang-1.13, golang-1.14, golang-1.16, golang-1.17...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang | — | Not in release | Not in release | Not in release |
| golang-1.13 | — | Not affected | Not affected | Not affected |
| golang-1.14 | — | Not in release | Not affected | Not in release |
| golang-1.16 | — | Not in release | Not affected | Not affected |
| golang-1.17 | — | Not affected | Not in release | Not in release |
| golang-1.18 | — | Not affected | Not affected | Not affected |
| golang-1.6 | — | Not in release | Not in release | Not in release |
| golang-1.8 | — | Not in release | Not in release | Not affected |
| golang-1.9 | — | Not in release | Not in release | Not affected |
| golang-1.10 | — | Not in release | Not in release | Not affected |
Some fixes available 10 of 19
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped,...
10 affected packages
golang-1.13, golang-1.18, golang-1.14, golang-1.16, golang-1.17...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.13 | Not in release | Fixed | Fixed | Fixed |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.14 | — | Not in release | Vulnerable | Not in release |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.17 | — | Vulnerable | Not in release | Not in release |
| golang-1.6 | — | Not in release | Not in release | Not in release |
| golang-1.8 | — | Not in release | Not in release | Vulnerable |
| golang-1.9 | — | Not in release | Not in release | Vulnerable |
| golang | — | Not in release | Not in release | Not in release |
| golang-1.10 | — | Not in release | Not in release | Vulnerable |
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked...
12 affected packages
golang-1.20, golang-1.13, golang-1.19, golang-1.18, golang...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.20 | Not in release | Needs evaluation | Needs evaluation | Not in release |
| golang-1.13 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.19 | Not in release | Not in release | Not in release | Not in release |
| golang-1.18 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | Not in release |
| golang-1.10 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Needs evaluation | Not in release |
| golang-1.16 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Needs evaluation | Not in release | Not in release |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Needs evaluation |
Some fixes available 3 of 16
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant...
10 affected packages
golang-1.17, golang-1.18, golang-1.19, golang-1.10, golang-1.13...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.17 | — | Not affected | Not in release | Not in release |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.19 | Not in release | Not in release | Not in release | Not in release |
| golang-1.10 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.13 | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.14 | Not in release | Not in release | Vulnerable | Not in release |
| golang-1.16 | Not in release | Not in release | Vulnerable | Vulnerable |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.9 | Not in release | Not in release | Not in release | Vulnerable |
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../...
9 affected packages
golang-1.10, golang-1.13, golang-1.14, golang-1.16, golang-1.17...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.10 | — | Not in release | Not in release | Not affected |
| golang-1.13 | — | Not affected | Not affected | Not affected |
| golang-1.14 | — | Not in release | Not affected | Not in release |
| golang-1.16 | — | Not in release | Not affected | Not affected |
| golang-1.17 | — | Not affected | Not in release | Not in release |
| golang-1.18 | — | Not affected | Not affected | Not affected |
| golang-1.6 | — | Not in release | Not in release | Not in release |
| golang-1.8 | — | Not in release | Not in release | Not affected |
| golang-1.9 | — | Not in release | Not in release | Not affected |
Some fixes available 10 of 19
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
11 affected packages
golang-1.13, golang, golang-1.10, golang-1.14, golang-1.16...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.13 | Not in release | Fixed | Fixed | Fixed |
| golang | Not in release | Not in release | Not in release | Not in release |
| golang-1.10 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Needs evaluation | Not in release |
| golang-1.16 | Not in release | Not in release | Fixed | Fixed |
| golang-1.17 | Not in release | Needs evaluation | Not in release | Not in release |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.15 | — | — | Not in release | Not in release |
httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\ vs....
14 affected packages
golang, golang-1.6, golang-1.8, golang-1.9, golang-1.10...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | — |
| golang-1.6 | Not in release | Not in release | Not in release | — |
| golang-1.8 | Not in release | Not in release | Not in release | Not affected |
| golang-1.9 | Not in release | Not in release | Not in release | Not affected |
| golang-1.10 | Not in release | Not in release | Not in release | Not affected |
| golang-1.13 | Not in release | Not affected | Not affected | Not affected |
| golang-1.14 | Not in release | Not in release | Not affected | — |
| golang-1.16 | Not in release | Not in release | Not affected | Not affected |
| golang-1.17 | Not in release | Not affected | Not in release | — |
| golang-1.18 | Not in release | Not affected | Not affected | Not affected |
| golang-1.19 | Not in release | Not in release | Not in release | — |
| golang-1.20 | Not in release | Not affected | Not affected | — |
| golang-1.21 | Not affected | Not affected | Not affected | — |
| golang-1.22 | Not affected | Not affected | Not affected | — |
Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
6 affected packages
golang-1.11, golang-1.15, golang-1.17, golang-1.18, golang-1.7, golang-1.8
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.11 | — | — | — | — |
| golang-1.15 | — | — | — | — |
| golang-1.17 | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not affected | Not affected | Not affected |
| golang-1.7 | — | — | — | — |
| golang-1.8 | — | — | — | Needs evaluation |
Some fixes available 10 of 13
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
8 affected packages
golang-1.17, golang-1.18, golang-1.7, golang-1.8, golang-1.11...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.17 | Not in release | Vulnerable | — | — |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.7 | — | — | — | — |
| golang-1.8 | — | — | — | Not affected |
| golang-1.11 | — | — | — | — |
| golang-1.15 | — | — | — | — |
| golang-1.16 | Not in release | Not in release | Fixed | Fixed |
| golang-1.13 | Not in release | Fixed | Fixed | Fixed |
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when...
6 affected packages
golang-1.18, golang-1.11, golang-1.15, golang-1.17, golang-1.7, golang-1.8
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Not affected | Not affected | Not affected |
| golang-1.11 | — | — | — | — |
| golang-1.15 | — | — | — | — |
| golang-1.17 | — | Not affected | — | — |
| golang-1.7 | — | — | — | — |
| golang-1.8 | — | — | — | Not affected |