Most recent entries from all

ALSA-2022:7129 — Moderate: git-lfs security and bug fix update

2026-10-02T18:36:56.393054+00:00

Affected: AlmaLinux:8: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851) * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* git-lfs needs to be rebuild with golang 1.17.7-1 or above

Withdrawn: BELL-CVE-2022-32189 — CVE-2022-32189 does not affect BellSoft software

2026-10-02T18:36:56.393164+00:00

Withdrawn by the publisher.

BIT-golang-2022-32189 — Panic when decoding Float and Rat types in math/big

2026-10-02T18:36:56.393184+00:00

Affected: Bitnami: golang

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

certfr-2022-avi-1040 — De multiples vulnérabilités ont été découvertes dans IBM Spectrum Protect. Certaines d'entre elles permettent à un atta…

2026-10-02T18:36:56.393205+00:00

certfr-2022-avi-1040

EUVD-2026-17231

2026-10-02T18:36:56.393226+00:00

EUVD-2026-17231

fkie_cve-2022-32189

2026-10-02T18:36:56.393239+00:00

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

GHSA-3rm2-w8f7-h7rf

2026-10-02T18:36:56.393260+00:00

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

gsd-2022-32189

2026-10-02T18:36:56.393275+00:00

gsd-2022-32189

msrc_CVE-2022-32189 — Panic when decoding Float and Rat types in math/big

2026-10-02T18:36:56.393286+00:00

msrc_CVE-2022-32189

OESA-2022-1830 — golang security update

2026-10-02T18:36:56.393302+00:00

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP3: golang, openEuler:22.03-LTS: golang

The Go Programming Language Security Fix(es): A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. References: https://go.dev/issue/53871 https://groups.google.com/g/golang-nuts/c/DCFSyTGM0wU Upstream Commits: Master : https://github.com/golang/go/commit/055113ef364337607e3e72ed7d48df67fde6fc66 Branch.go1.17 : https://github.com/golang/go/commit/703c8ab7e5ba75c95553d4e249309297abad7102 Branch.go1.18 : https://github.com/golang/go/commit/9240558e4f342fc6e98fec22de17c04b45089349(CVE-2022-32189)

openSUSE-SU-2024:12229-1 — go1.17-1.17.13-1.1 on GA media

2026-10-02T18:36:56.393329+00:00

go1.17-1.17.13-1.1 on GA media

RHSA-2022:7398 — Red Hat Security Advisory: OpenShift Container Platform 4.12.0 packages and security update

2026-10-02T18:36:56.393346+00:00

go-yaml: Denial of Service in go-yaml golang: net/http: improper sanitization of Transfer-Encoding header golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters cri-o: incorrect handling of the supplementary groups python-scciclient: missing server certificate verification kubernetes: Unauthorized read of Custom Resources kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) OpenShift: Missing HTTP Strict Transport Security cri-o: Security regression of CVE-2022-27652 golang: net/http: handle server errors after sending GOAWAY golang: compress/gzip: stack exhaustion in Reader.Read golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service golang: net/url: JoinPath does not strip relative path components in all circumstances golang: regexp/syntax: limit memory used by parsing regexps

UBUNTU-CVE-2022-32189

2026-10-02T18:36:56.393388+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:18.04:LTS: golang-1.9 and 7 more

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

WID-SEC-W-2022-2044 — Red Hat Enterprise Linux: Mehrere Schwachstellen

2026-10-02T18:36:56.393429+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen, Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.