VuXML ID | Description |
67b050ae-ec82-11ea-9071-10c37b4ac2ea | go -- net/http/cgi, net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified
The Go project reports:
When a Handler does not explicitly set the Content-Type header, both
CGI implementations default to âtext/htmlâ. If an attacker can make
a server generate content under their control (e.g. a JSON
containing user data or an uploaded image file) this might be
mistakenly returned by the server as âtext/htmlâ. If a victim visits
such a page they could get the attacker's code executed in the
context of the server origin. If an attacker can make a server
generate content under their control (e.g. a JSON containing user
data or an uploaded image file) this might be mistakenly returned by
the server as âtext/htmlâ. If a victim visits such a page they could
get the attacker's code executed in the context of the server
origin.
Discovery 2020-08-20 Entry 2020-09-01 go
< 1.14.8,1
ge 1.15,1 lt 1.15.1,1
CVE-2020-24553
https://github.com/golang/go/issues/40928
|
db4b2f27-252a-11eb-865c-00155d646400 | go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo
The Go project reports:
A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem,
QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic
when provided crafted large inputs. For the panic to happen,
the divisor or modulo argument must be larger than 3168 bits
(on 32-bit architectures) or 6336 bits (on 64-bit architectures).
Multiple math/big.Rat methods are similarly affected.
The go command may execute arbitrary code at build time when
cgo is in use. This may occur when running go get on a malicious
package, or any other command that builds untrusted code. This
can be caused by a malicious gcc flags specified via a #cgo
directive.
The go command may execute arbitrary code at build time when
cgo is in use. This may occur when running go get on a malicious
package, or any other command that builds untrusted code. This
can be caused by malicious unquoted symbol names.
Discovery 2020-11-09 Entry 2020-11-12 go
< 1.15.5,1
CVE-2020-28367
CVE-2020-28362
https://github.com/golang/go/issues/42552
https://github.com/golang/go/issues/42556
CVE-2020-28366
https://github.com/golang/go/issues/42559
|
6a4805d5-5aaf-11eb-a21d-79f5bc5ef6a9 | go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve
The Go project reports:
The go command may execute arbitrary code at build time when cgo is
in use on Windows. This may occur when running "go get", or
any other command that builds code. Only users who build untrusted
code (and don't execute it) are affected. In addition to Windows
users, this can also affect Unix users who have "." listed
explicitly in their PATH and are running "go get" or build
commands outside of a module or with module mode disabled.
The P224() Curve implementation can in rare circumstances generate
incorrect outputs, including returning invalid points from
ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not
crypto/tls) packages support P-224 ECDSA keys, but they are not
supported by publicly trusted certificate authorities. No other
standard library or golang.org/x/crypto package supports or uses the
P-224 curve.
Discovery 2021-01-13 Entry 2021-01-19 go
< 1.15.7,1
CVE-2021-3115
http://golang.org/issue/43783
CVE-2021-3114
http://golang.org/issue/43786
|
c365536d-e3cf-11eb-9d8d-b37b683944c2 | go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters
The Go project reports:
crypto/tls clients can panic when provided a certificate of
the wrong type for the negotiated parameters. net/http clients
performing HTTPS requests are also affected. The panic can be
triggered by an attacker in a privileged network position
without access to the server certificate's private key, as
long as a trusted ECDSA or Ed25519 certificate for the server
exists (or can be issued), or the client is configured with
Config.InsecureSkipVerify. Clients that disable all TLS_RSA
cipher suites (that is, TLS 1.0âÂÂ1.2 cipher suites without
ECDHE), as well as TLS 1.3-only clients, are unaffected.
Discovery 2021-07-07 Entry 2021-07-12 go
< 1.16.6,1
CVE-2021-34558
https://github.com/golang/go/issues/47143
|
4ea1082a-1259-11ec-b4fa-dd5a552bdd17 | go -- archive/zip: overflow in preallocation check can cause OOM panic
The Go project reports:
An oversight in the previous fix still allows for an OOM
panic when the indicated directory size in the archive
header is so large that subtracting it from the archive
size overflows a uint64, effectively bypassing the check
that the number of files in the archive is reasonable.
Discovery 2021-08-18 Entry 2021-09-10 go
< 1.17.1,1
CVE-2021-39293
https://github.com/golang/go/issues/47801
|
72709326-81f7-11eb-950a-00155d646401 | go -- encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader; archive/zip: panic when calling Reader.Open
The Go project reports:
The Decode, DecodeElement, and Skip methods of an xml.Decoder
provided by xml.NewTokenDecoder may enter an infinite loop when
operating on a custom xml.TokenReader which returns an EOF in the
middle of an open XML element.
The Reader.Open API, new in Go 1.16, will panic when used on a ZIP
archive containing files that start with "../".
Discovery 2021-03-05 Entry 2021-03-10 go
< 1.16.1,1
CVE-2021-27918
http://golang.org/issue/44913
CVE-2021-27919
http://golang.org/issue/44916
|
096ab080-907c-11ec-bb14-002324b2fba8 | go -- multiple vulnerabilities
The Go project reports:
crypto/elliptic: fix IsOnCurve for big.Int values that are not
valid coordinates
Some big.Int values that are not valid field elements (negative or
overflowing) might cause Curve.IsOnCurve to incorrectly return true.
Operating on those values may cause a panic or an invalid curve
operation. Note that Unmarshal will never return such values.
math/big: prevent large memory consumption in Rat.SetString
An attacker can cause unbounded memory growth in a program using
(*Rat).SetString due to an unhandled overflow.
cmd/go: prevent branches from materializing into versions
A branch whose name resembles a version tag (such as "v1.0.0" or
"subdir/v2.0.0-dev") can be considered a valid version by the go
command. Materializing versions from branches might be unexpected
and bypass ACLs that limit the creation of tags but not branches.
Discovery 2022-02-10 Entry 2022-02-18 go
< 1.17.7,1
CVE-2022-23806
https://github.com/golang/go/issues/50974
CVE-2022-23772
https://github.com/golang/go/issues/50699
CVE-2022-23773
https://github.com/golang/go/issues/35671
|
bc7aff8c-d806-11ea-a5aa-0800272260e5 | go -- encoding/binary: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
The Go project reports:
Certain invalid inputs to ReadUvarint or ReadVarint could cause
those functions to read an unlimited number of bytes from the
ByteReader argument before returning an error. This could lead to
processing more input than expected when the caller is reading
directly from the network and depends on ReadUvarint and ReadVarint
only consuming a small, bounded number of bytes, even from invalid
inputs.
Discovery 2020-08-06 Entry 2020-08-06 go
< 1.14.7,1
CVE-2020-16845
https://github.com/golang/go/issues/40618
|
720505fe-593f-11ec-9ba8-002324b2fba8 | go -- multiple vulnerabilities
The Go project reports:
net/http: limit growth of header canonicalization cache. An
attacker can cause unbounded memory growth in a Go server accepting
HTTP/2 requests.
syscall: donâÂÂt close fd 0 on ForkExec error. When a Go program
running on a Unix system is out of file descriptors and calls
syscall.ForkExec (including indirectly by using the os/exec
package), syscall.ForkExec can close file descriptor 0 as it fails.
If this happens (or can be provoked) repeatedly, it can result in
misdirected I/O such as writing network traffic intended for one
connection to a different connection, or content intended for one
file to a different one.
Discovery 2021-12-08 Entry 2021-12-09 go
< 1.17.5,1
CVE-2021-44716
https://github.com/golang/go/issues/50058
CVE-2021-44717
https://github.com/golang/go/issues/50057
|
079b3641-c4bd-11eb-a22a-693f0544ae52 | go -- multiple vulnerabilities
The Go project reports:
The SetString and UnmarshalText methods of math/big.Rat may cause a
panic or an unrecoverable fatal error if passed inputs with very
large exponents.
ReverseProxy in net/http/httputil could be made to forward certain
hop-by-hop headers, including Connection. In case the target of the
ReverseProxy was itself a reverse proxy, this would let an attacker
drop arbitrary headers, including those set by the
ReverseProxy.Director.
The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr
functions in net, and their respective methods on the Resolver type
may return arbitrary values retrieved from DNS which do not follow
the established RFC 1035 rules for domain names. If these names are
used without further sanitization, for instance unsafely included in
HTML, they may allow for injection of unexpected content. Note that
LookupTXT may still return arbitrary values that could require
sanitization before further use.
The NewReader and OpenReader functions in archive/zip can cause a
panic or an unrecoverable fatal error when reading an archive that
claims to contain a large number of files, regardless of its actual
size.
Discovery 2021-05-01 Entry 2021-06-03 go
< 1.16.5,1
CVE-2021-33198
https://github.com/golang/go/issues/45910
CVE-2021-33197
https://github.com/golang/go/issues/46313
CVE-2021-33195
https://github.com/golang/go/issues/46241
CVE-2021-33196
https://github.com/golang/go/issues/46242
|
880552c4-f63f-11eb-9d56-7186043316e9 | go -- net/http: panic due to racy read of persistConn after handler panic
The Go project reports:
A net/http/httputil ReverseProxy can panic due to a race
condition if its Handler aborts with ErrAbortHandler, for
example due to an error in copying the response body. An
attacker might be able to force the conditions leading to
the race condition.
Discovery 2021-06-21 Entry 2021-08-05 go
< 1.16.7,1
CVE-2021-36221
https://github.com/golang/go/issues/46866
|
930def19-3e05-11ec-9ba8-002324b2fba8 | go -- multiple vulnerabilities
The Go project reports:
debug/macho fails out when loading a file that contains a dynamic
symbol table command that indicates a larger number of symbols than
exist in the loaded symbol table.
Previously, opening a zip with (*Reader).Open could result in a
panic if the zip contained a file whose name was exclusively made up
of slash characters or ".." path elements. Open could also panic if
passed the empty string directly as an argument.
Discovery 2021-11-04 Entry 2021-11-05 go
< 1.17.3,1
CVE-2021-41771
https://github.com/golang/go/issues/48990
CVE-2021-41772
https://github.com/golang/go/issues/48085
|
a92dcc5c-e05c-11e9-b589-10c37b4ac2ea | go -- invalid headers are normalized, allowing request smuggling
The Go project reports:
net/http (through net/textproto) used to accept and normalize invalid
HTTP/1.1 headers with a space before the colon, in violation of RFC 7230.
If a Go server is used behind a reverse proxy that accepts and forwards
but doesn't normalize such invalid headers, the reverse proxy and the
server can interpret the headers differently. This can lead to filter
bypasses or request smuggling, the latter if requests from separate clients
are multiplexed onto the same connection by the proxy. Such invalid headers
are now rejected by Go servers, and passed without normalization to Go
client applications.
Discovery 2019-09-25 Entry 2019-09-26 go
< 1.13.1,1
go-devel
< g20190925
CVE-2019-16276
https://github.com/golang/go/issues/34540
|
a1360138-d446-11ec-8ea1-10c37b4ac2ea | go -- syscall.Faccessat checks wrong group on Linux
The Go project reports:
When called with a non-zero flags parameter, the
syscall.Faccessat function could incorrectly report that a
file is accessible. This bug only occurs on Linux systems.
Discovery 2022-04-12 Entry 2022-05-15 go
< 1.18.2,1
go117
< 1.17.10
CVE-2022-29526
https://github.com/golang/go/issues/52313
https://groups.google.com/g/golang-dev/c/CPU3TB6d4oY
|
e2af876f-a7c8-11ec-9a2a-002324b2fba8 | go -- multiple vulnerabilities
The Go project reports:
regexp: stack exhaustion compiling deeply nested expressions
On 64-bit platforms, an extremely deeply nested expression can
cause regexp.Compile to cause goroutine stack exhaustion, forcing
the program to exit. Note this applies to very large expressions, on
the order of 2MB.
Discovery 2022-02-09 Entry 2022-03-19 go
< 1.17.8,1
CVE-2022-24921
https://github.com/golang/go/issues/51112
|
7f242313-aea5-11eb-8151-67f74cf7c704 | go -- net/http: ReadRequest can stack overflow due to recursion with very large headers
The Go project reports:
http.ReadRequest can stack overflow due to recursion when given a
request with a very large header (~8-10MB depending on the
architecture). A http.Server which overrides the default max header
of 1MB by setting Server.MaxHeaderBytes to a much larger value could
also be vulnerable in the same way.
Discovery 2021-04-22 Entry 2021-05-06 go
< 1.16.4,1
CVE-2021-31525
https://github.com/golang/go/issues/45710
|
4fce9635-28c0-11ec-9ba8-002324b2fba8 | go -- misc/wasm, cmd/link: do not let command line arguments overwrite global data
The Go project reports:
When invoking functions from WASM modules, built using GOARCH=wasm
GOOS=js, passing very large arguments can cause portions of the module
to be overwritten with data from the arguments.
If using wasm_exec.js to execute WASM modules, users will need to
replace their copy after rebuilding any modules.
Discovery 2021-10-06 Entry 2021-10-09 go
< 1.17.2,1
CVE-2021-38297
https://github.com/golang/go/issues/48797
|
61bce714-ca0c-11ec-9cfc-10c37b4ac2ea | go -- multiple vulnerabilities
The Go project reports:
encoding/pem: fix stack overflow in Decode.
A large (more than 5 MB) PEM input can cause a stack
overflow in Decode, leading the program to crash.
crypto/elliptic: tolerate all oversized scalars in generic
P-256.
A crafted scalar input longer than 32 bytes can
cause P256().ScalarMult or P256().ScalarBaseMult to panic.
Indirect uses through crypto/ecdsa and crypto/tls are
unaffected. amd64, arm64, ppc64le, and s390x are
unaffected.
crypto/x509: non-compliant certificates can cause a panic
in Verify on macOS in Go 1.18.
Verifying certificate chains containing certificates
which are not compliant with RFC 5280 causes
Certificate.Verify to panic on macOS. These chains can be
delivered through TLS and can cause a crypto/tls or
net/http client to crash.
Discovery 2022-04-12 Entry 2022-05-02 go
< 1.18.1,1
go117
< 1.17.9
CVE-2022-24675
https://github.com/golang/go/issues/51853
CVE-2022-28327
https://github.com/golang/go/issues/52075
CVE-2022-27536
https://github.com/golang/go/issues/51759
|