rpm package
opensuse/go1.15&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/go1.15&distro=openSUSE%20Tumbleweed
Vulnerabilities (14)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-36221 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Aug 8, 2021 | Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. | ||
| CVE-2021-33198 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Aug 2, 2021 | In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. | ||
| CVE-2021-33197 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Aug 2, 2021 | In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. | ||
| CVE-2021-33195 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Aug 2, 2021 | Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. | ||
| CVE-2021-33196 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Aug 2, 2021 | In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. | ||
| CVE-2021-34558 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Jul 15, 2021 | The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. | ||
| CVE-2021-31525 | — | < 1.15.15-1.2 | 1.15.15-1.2 | May 27, 2021 | net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations. | ||
| CVE-2021-27918 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Mar 10, 2021 | encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method. | ||
| CVE-2021-3114 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Jan 26, 2021 | In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field. | ||
| CVE-2021-3115 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Jan 26, 2021 | Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download). | ||
| CVE-2020-28362 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Nov 18, 2020 | Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. | ||
| CVE-2020-28367 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Nov 18, 2020 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. | ||
| CVE-2020-28366 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Nov 18, 2020 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file. | ||
| CVE-2020-24553 | — | < 1.15.15-1.2 | 1.15.15-1.2 | Sep 2, 2020 | Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. |
- CVE-2021-36221Aug 8, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
- CVE-2021-33198Aug 2, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
- CVE-2021-33197Aug 2, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
- CVE-2021-33195Aug 2, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
- CVE-2021-33196Aug 2, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
- CVE-2021-34558Jul 15, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
- CVE-2021-31525May 27, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
- CVE-2021-27918Mar 10, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
- CVE-2021-3114Jan 26, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
- CVE-2021-3115Jan 26, 2021affected < 1.15.15-1.2fixed 1.15.15-1.2
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
- CVE-2020-28362Nov 18, 2020affected < 1.15.15-1.2fixed 1.15.15-1.2
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
- CVE-2020-28367Nov 18, 2020affected < 1.15.15-1.2fixed 1.15.15-1.2
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
- CVE-2020-28366Nov 18, 2020affected < 1.15.15-1.2fixed 1.15.15-1.2
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
- CVE-2020-24553Sep 2, 2020affected < 1.15.15-1.2fixed 1.15.15-1.2
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.