Product:

Go

(Golang)
Repositories https://github.com/golang/go
#Vulnerabilities 121
Date Id Summary Products Score Patch Annotated
2021-03-11 CVE-2021-27919 archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename. Fedora, Go 5.5
2021-05-26 CVE-2021-33194 golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input. Fedora, Go 7.5
2021-05-27 CVE-2021-31525 net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations. Fedora, Go 5.9
2021-07-15 CVE-2021-34558 The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. Fedora, Go, Cloud_insights_telegraf, Storagegrid, Trident, Timesten_in\-Memory_database 6.5
2021-08-07 CVE-2021-29923 Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR. Fedora, Go, Timesten_in\-Memory_database 7.5
2021-08-08 CVE-2021-36221 Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. Debian_linux, Fedora, Go, Timesten_in\-Memory_database, Scalance_lpe9403_firmware 5.9
2021-10-18 CVE-2021-38297 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used. Fedora, Go 9.8
2021-11-08 CVE-2021-41771 ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. Debian_linux, Fedora, Go 7.5
2021-11-08 CVE-2021-41772 Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field. Fedora, Go, Timesten_in\-Memory_database 7.5
2022-04-20 CVE-2022-24675 encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. Fedora, Go, Kubernetes_monitoring_operator 7.5