Most recent entries from all

bdu:2022-01896

Withdrawn: BELL-CVE-2021-29923 — CVE-2021-29923 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2021-29923

Affected: Bitnami: golang

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

certfr-2021-avi-943 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2021-avi-943

EUVD-2026-26580

fkie_cve-2021-29923

GHSA-38h6-vxp4-qxvm

gsd-2021-29923

msrc_CVE-2021-29923 — Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet which (in…

msrc_CVE-2021-29923

OESA-2021-1402 — golang security update

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP2: golang

The go programming language Security Fix(es): Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.(CVE-2021-33195)

In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive s header) can cause a NewReader or OpenReader panic.(CVE-2021-33196)

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.(CVE-2021-33197)

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.(CVE-2021-33198)

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.(CVE-2021-34558)

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a…

RHSA-2021:3431 — Red Hat Security Advisory: go-toolset-1.15-golang security update

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet golang: net: lookup functions may return invalid host names golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

RHSA-2021:3585 — Red Hat Security Advisory: go-toolset:rhel8 security update

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

UBUNTU-CVE-2021-29923

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:18.04:LTS: golang-1.9, Ubuntu:20.04:LTS: golang-1.13 and 3 more

WID-SEC-W-2022-0941 — Red Hat OpenShift: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um die Integrität und die Verfügbarkeit zu gefährden.