Summary
Detail | |||
---|---|---|---|
Vendor | Golang | First view | 2016-05-23 |
Product | Go | Last view | 2022-06-23 |
Version | 1.5 | Type | Application |
Update | rc1 | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:a:golang:go |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
5.3 | 2022-06-23 | CVE-2022-29526 | Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible. |
7.5 | 2022-04-20 | CVE-2022-28327 | The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. |
7.5 | 2022-04-20 | CVE-2022-27536 | Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic. |
7.5 | 2022-04-20 | CVE-2022-24675 | encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. |
7.5 | 2022-03-05 | CVE-2022-24921 | regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. |
9.1 | 2022-02-11 | CVE-2022-23806 | Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. |
7.5 | 2022-02-11 | CVE-2022-23773 | cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags. |
7.5 | 2022-02-11 | CVE-2022-23772 | Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. |
7.5 | 2022-01-24 | CVE-2021-39293 | In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196. |
4.8 | 2022-01-01 | CVE-2021-44717 | Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion. |
7.5 | 2022-01-01 | CVE-2021-44716 | net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. |
8.8 | 2021-12-24 | CVE-2021-23772 | This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder. |
7.5 | 2021-11-08 | CVE-2021-41772 | Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field. |
7.5 | 2021-11-08 | CVE-2021-41771 | ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. |
9.8 | 2021-10-18 | CVE-2021-38297 | Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used. |
5.9 | 2021-08-08 | CVE-2021-36221 | Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. |
7.5 | 2021-08-07 | CVE-2021-29923 | Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR. |
7.5 | 2021-08-02 | CVE-2021-33198 | In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. |
5.3 | 2021-08-02 | CVE-2021-33197 | In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. |
7.5 | 2021-08-02 | CVE-2021-33196 | In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. |
7.3 | 2021-08-02 | CVE-2021-33195 | Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. |
6.5 | 2021-07-15 | CVE-2021-34558 | The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. |
5.9 | 2021-05-27 | CVE-2021-31525 | net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations. |
7.5 | 2021-05-26 | CVE-2021-33194 | golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input. |
5.5 | 2021-03-11 | CVE-2021-27919 | archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
14% (6) | CWE-295 | Certificate Issues |
9% (4) | CWE-20 | Improper Input Validation |
7% (3) | CWE-770 | Allocation of Resources Without Limits or Throttling |
7% (3) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
4% (2) | CWE-682 | Incorrect Calculation |
4% (2) | CWE-427 | Uncontrolled Search Path Element |
4% (2) | CWE-362 | Race Condition |
4% (2) | CWE-269 | Improper Privilege Management |
4% (2) | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
2% (1) | CWE-674 | Uncontrolled Recursion |
2% (1) | CWE-668 | Exposure of Resource to Wrong Sphere |
2% (1) | CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggli... |
2% (1) | CWE-436 | Interpretation Conflict |
2% (1) | CWE-319 | Cleartext Transmission of Sensitive Information |
2% (1) | CWE-284 | Access Control (Authorization) Issues |
2% (1) | CWE-264 | Permissions, Privileges, and Access Controls |
2% (1) | CWE-252 | Unchecked Return Value |
2% (1) | CWE-190 | Integer Overflow or Wraparound |
2% (1) | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflo... |
2% (1) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
2% (1) | CWE-88 | Argument Injection or Modification |
2% (1) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
2% (1) | CWE-78 | Improper Sanitization of Special Elements used in an OS Command ('O... |
2% (1) | CWE-74 | Failure to Sanitize Data into a Different Plane ('Injection') |
2% (1) | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
Snort® IPS/IDS
Date | Description |
---|---|
2019-05-14 | Go binary bll-load exploit attempt RuleID : 49786 - Type : FILE-OTHER - Revision : 1 |
2019-05-14 | Go binary dll-load exploit attempt RuleID : 49785 - Type : FILE-OTHER - Revision : 1 |
2019-05-14 | Go binary dll-load exploit attempt RuleID : 49784 - Type : FILE-OTHER - Revision : 1 |
2019-05-14 | Go binary dll-load exploit attempt RuleID : 49783 - Type : FILE-OTHER - Revision : 1 |
2019-05-14 | Go binary dll-load exploit attempt RuleID : 49782 - Type : FILE-OTHER - Revision : 1 |
2019-05-14 | Go binary dll-load exploit attempt RuleID : 49781 - Type : FILE-OTHER - Revision : 1 |
2019-04-02 | Google Golang GET command injection attempt RuleID : 49304 - Type : SERVER-OTHER - Revision : 1 |
2016-07-28 | HttpOxy CGI application vulnerability potential man-in-the-middle attempt RuleID : 39737-community - Type : SERVER-WEBAPP - Revision : 2 |
2016-08-31 | HttpOxy CGI application vulnerability potential man-in-the-middle attempt RuleID : 39737 - Type : SERVER-WEBAPP - Revision : 2 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2019-01-11 | Name: The remote Fedora host is missing a security update. File: fedora_2019-c424e3bb72.nasl - Type: ACT_GATHER_INFO |
2019-01-11 | Name: The remote Fedora host is missing a security update. File: fedora_2019-1198005e1f.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-fe65c14082.nasl - Type: ACT_GATHER_INFO |
2018-12-24 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201812-09.nasl - Type: ACT_GATHER_INFO |
2018-12-17 | Name: The remote Amazon Linux AMI host is missing a security update. File: ala_ALAS-2018-1130.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-1_0-0123.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-1_0-0117.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-0045.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-0039.nasl - Type: ACT_GATHER_INFO |
2018-07-24 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-2_0-0034.nasl - Type: ACT_GATHER_INFO |
2018-07-24 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-2_0-0026.nasl - Type: ACT_GATHER_INFO |
2018-05-11 | Name: The remote Amazon Linux 2 host is missing a security update. File: al2_ALAS-2018-1011.nasl - Type: ACT_GATHER_INFO |
2018-04-27 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2018-0878.nasl - Type: ACT_GATHER_INFO |
2018-04-16 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201804-12.nasl - Type: ACT_GATHER_INFO |
2018-03-27 | Name: The remote Amazon Linux AMI host is missing a security update. File: ala_ALAS-2018-975.nasl - Type: ACT_GATHER_INFO |
2018-03-08 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201803-03.nasl - Type: ACT_GATHER_INFO |
2018-02-28 | Name: The remote Fedora host is missing a security update. File: fedora_2018-6f08b79a09.nasl - Type: ACT_GATHER_INFO |
2018-02-26 | Name: The remote Debian host is missing a security update. File: debian_DLA-1294.nasl - Type: ACT_GATHER_INFO |
2018-02-21 | Name: The remote Fedora host is missing a security update. File: fedora_2018-5562b6e2c0.nasl - Type: ACT_GATHER_INFO |
2018-01-15 | Name: The remote Fedora host is missing a security update. File: fedora_2017-f4fc897e8f.nasl - Type: ACT_GATHER_INFO |
2017-12-01 | Name: The remote EulerOS host is missing a security update. File: EulerOS_SA-2017-1311.nasl - Type: ACT_GATHER_INFO |
2017-11-06 | Name: The remote Amazon Linux AMI host is missing a security update. File: ala_ALAS-2017-918.nasl - Type: ACT_GATHER_INFO |
2017-10-30 | Name: The remote Debian host is missing a security update. File: debian_DLA-1148.nasl - Type: ACT_GATHER_INFO |
2017-10-23 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201710-23.nasl - Type: ACT_GATHER_INFO |
2017-10-20 | Name: The remote Fedora host is missing a security update. File: fedora_2017-8f7bca960b.nasl - Type: ACT_GATHER_INFO |