Search CVE reports
61 – 70 of 94 results
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Fixed | Fixed | Fixed |
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses...
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Fixed | Fixed | Fixed |
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Fixed | Fixed | Fixed |
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Fixed | Fixed | Fixed |
Some fixes available 5 of 7
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Not affected | Not affected | Not affected |
Some fixes available 10 of 13
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
8 affected packages
golang-1.17, golang-1.18, golang-1.7, golang-1.8, golang-1.11...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.17 | Not in release | Vulnerable | — | — |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.7 | — | — | — | — |
| golang-1.8 | — | — | — | Not affected |
| golang-1.11 | — | — | — | — |
| golang-1.15 | — | — | — | — |
| golang-1.16 | Not in release | Not in release | Fixed | Fixed |
| golang-1.13 | Not in release | Fixed | Fixed | Fixed |
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Fixed | Fixed | Fixed |
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the...
3 affected packages
golang-1.18, golang-1.16, golang-1.13
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.18 | — | Fixed | Fixed | Fixed |
| golang-1.16 | — | Not in release | Fixed | Fixed |
| golang-1.13 | — | Fixed | Fixed | Fixed |
Some fixes available 6 of 19
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
11 affected packages
golang-1.16, golang-1.13, golang, golang-1.18, golang-1.10...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.16 | Not in release | Not in release | Fixed | Fixed |
| golang-1.13 | Not in release | Not affected | Not affected | Not affected |
| golang | Not in release | Not in release | Not in release | Not in release |
| golang-1.18 | Not in release | Fixed | Fixed | Fixed |
| golang-1.10 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Needs evaluation | Not in release |
| golang-1.17 | Not in release | Needs evaluation | Not in release | Not in release |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.15 | — | — | Not in release | Not in release |
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
9 affected packages
golang-1.6, golang-1.10, golang-1.13, golang-1.15, golang-1.14...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| golang-1.6 | — | — | — | — |
| golang-1.10 | — | — | — | Needs evaluation |
| golang-1.13 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.15 | — | — | — | — |
| golang-1.14 | — | — | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Needs evaluation | — | — |
| golang-1.8 | — | — | — | Needs evaluation |
| golang-1.9 | — | — | — | Needs evaluation |