Most recent entries from all

EUVD-2026-47378

fkie_cve-2020-29529

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

GHSA-2g5j-5x95-r6hr — Unsafe tar unpacking in HashiCorp go-slug

Affected: Go: github.com/hashicorp/go-slug

HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.

gsd-2020-29529

RHSA-2021:1168 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag go-slug: partial protection against zip slip attacks fastify-reply-from: crafted URL allows prefix scape of the proxied backend service fastify-http-proxy: crafted URL allows prefix scape of the proxied backend service nodejs-lodash: command injection via template openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash()

Withdrawn: UBUNTU-CVE-2020-29529

Withdrawn by the publisher.

Affected: Ubuntu:22.04:LTS: golang-github-hashicorp-go-slug