Search CVE reports

Toggle filters

51 – 60 of 77 results

CVE-2022-32189

Medium priority

Some fixes available 10 of 19

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

11 affected packages

golang, golang-1.10, golang-1.13, golang-1.14, golang-1.15...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang Not in release Not in release Not in release Not in release Not in release
golang-1.10 Not in release Not in release Not in release Needs evaluation Needs evaluation
golang-1.13 Not in release Fixed Fixed Fixed Fixed
golang-1.14 Not in release Not in release Needs evaluation Not in release Not in release
golang-1.15 — — Not in release Not in release Not in release
golang-1.16 Not in release Not in release Fixed Fixed Ignored
golang-1.17 Not in release Needs evaluation Not in release Not in release Ignored
golang-1.18 Not in release Fixed Fixed Fixed Fixed
golang-1.6 Not in release Not in release Not in release Not in release Needs evaluation
golang-1.8 Not in release Not in release Not in release Needs evaluation Not in release
golang-1.9 Not in release Not in release Not in release Needs evaluation Not in release
Show all 11 packages Show less packages

CVE-2022-32148

Medium priority
Fixed

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For...

3 affected packages

golang-1.13, golang-1.16, golang-1.18

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.13 — Fixed Fixed Fixed Fixed
golang-1.16 — Not in release Fixed Fixed Ignored
golang-1.18 — Fixed Fixed Fixed Not in release
Show less packages

CVE-2022-30635

Medium priority
Fixed

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

3 affected packages

golang-1.13, golang-1.16, golang-1.18

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.13 — Fixed Fixed Fixed Fixed
golang-1.16 — Not in release Fixed Fixed Ignored
golang-1.18 — Fixed Fixed Fixed Not in release
Show less packages

CVE-2022-30633

Medium priority
Fixed

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses...

3 affected packages

golang-1.13, golang-1.16, golang-1.18

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.13 — Fixed Fixed Fixed Fixed
golang-1.16 — Not in release Fixed Fixed Ignored
golang-1.18 — Fixed Fixed Fixed Not in release
Show less packages

CVE-2022-30632

Medium priority
Fixed

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

3 affected packages

golang-1.13, golang-1.16, golang-1.18

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.13 — Fixed Fixed Fixed Fixed
golang-1.16 — Not in release Fixed Fixed Ignored
golang-1.18 — Fixed Fixed Fixed Not in release
Show less packages

CVE-2022-30631

Medium priority
Fixed

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

3 affected packages

golang-1.13, golang-1.16, golang-1.18

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.13 — Fixed Fixed Fixed Fixed
golang-1.16 — Not in release Fixed Fixed Ignored
golang-1.18 — Fixed Fixed Fixed Not in release
Show less packages

CVE-2022-30630

Medium priority

Some fixes available 5 of 7

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

3 affected packages

golang-1.13, golang-1.16, golang-1.18

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.13 — Not affected Not affected Not affected Not affected
golang-1.16 — Not in release Fixed Fixed Ignored
golang-1.18 — Fixed Fixed Fixed Not in release
Show less packages

CVE-2022-30629

Medium priority

Some fixes available 10 of 13

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

8 affected packages

golang-1.11, golang-1.13, golang-1.15, golang-1.16, golang-1.17...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.11 — — — — —
golang-1.13 Not in release Fixed Fixed Fixed Fixed
golang-1.15 — — — — —
golang-1.16 Not in release Not in release Fixed Fixed Ignored
golang-1.17 Not in release Vulnerable — — —
golang-1.18 Not in release Fixed Fixed Fixed Fixed
golang-1.7 — — — — —
golang-1.8 — — — Not affected —
Show all 8 packages Show less packages

CVE-2022-28131

Medium priority
Fixed

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

3 affected packages

golang-1.13, golang-1.16, golang-1.18

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.13 — Fixed Fixed Fixed Fixed
golang-1.16 — Not in release Fixed Fixed Ignored
golang-1.18 — Fixed Fixed Fixed Not in release
Show less packages

CVE-2022-1705

Medium priority
Fixed

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the...

3 affected packages

golang-1.13, golang-1.16, golang-1.18

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.13 — Fixed Fixed Fixed Fixed
golang-1.16 — Not in release Fixed Fixed Ignored
golang-1.18 — Fixed Fixed Fixed Not in release
Show less packages
  1. Previous page
  2. 4
  3. 5
  4. 6
  5. 7
  6. 8
  7. Next page
Export to JSON