rpm package
suse/go1.15&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS
pkg:rpm/suse/go1.15&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-36221 | — | < 1.15.15-1.39.1 | 1.15.15-1.39.1 | Aug 8, 2021 | Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. | ||
| CVE-2021-33198 | — | < 1.15.13-1.33.1 | 1.15.13-1.33.1 | Aug 2, 2021 | In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. | ||
| CVE-2021-33197 | — | < 1.15.13-1.33.1 | 1.15.13-1.33.1 | Aug 2, 2021 | In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. | ||
| CVE-2021-33195 | — | < 1.15.13-1.33.1 | 1.15.13-1.33.1 | Aug 2, 2021 | Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. | ||
| CVE-2021-33196 | — | < 1.15.13-1.33.1 | 1.15.13-1.33.1 | Aug 2, 2021 | In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. | ||
| CVE-2021-27918 | — | < 1.15.10-1.25.1 | 1.15.10-1.25.1 | Mar 10, 2021 | encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method. | ||
| CVE-2021-3114 | — | < 1.15.7-1.17.1 | 1.15.7-1.17.1 | Jan 26, 2021 | In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field. | ||
| CVE-2021-3115 | — | < 1.15.7-1.17.1 | 1.15.7-1.17.1 | Jan 26, 2021 | Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download). |
- CVE-2021-36221Aug 8, 2021affected < 1.15.15-1.39.1fixed 1.15.15-1.39.1
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
- CVE-2021-33198Aug 2, 2021affected < 1.15.13-1.33.1fixed 1.15.13-1.33.1
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
- CVE-2021-33197Aug 2, 2021affected < 1.15.13-1.33.1fixed 1.15.13-1.33.1
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
- CVE-2021-33195Aug 2, 2021affected < 1.15.13-1.33.1fixed 1.15.13-1.33.1
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
- CVE-2021-33196Aug 2, 2021affected < 1.15.13-1.33.1fixed 1.15.13-1.33.1
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
- CVE-2021-27918Mar 10, 2021affected < 1.15.10-1.25.1fixed 1.15.10-1.25.1
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
- CVE-2021-3114Jan 26, 2021affected < 1.15.7-1.17.1fixed 1.15.7-1.17.1
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
- CVE-2021-3115Jan 26, 2021affected < 1.15.7-1.17.1fixed 1.15.7-1.17.1
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).