Most recent entries from all

ALSA-2022:1819 — Moderate: go-toolset:rhel8 security and bug fix update

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: Command-line arguments may overwrite global data (CVE-2021-38297)

* golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)

* golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

* golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

* golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)

* golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

* golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn: BELL-CVE-2021-39293 — CVE-2021-39293 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2021-39293

Affected: Bitnami: golang

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

certfr-2022-avi-547 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un atta…

certfr-2022-avi-547

cnvd-2022-55062

EUVD-2026-30552

fkie_cve-2021-39293

GHSA-j532-8pqq-78jr

gsd-2021-39293

ICSA-22-167-09 — Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP. The use of alloca function with an uncontrolled size in function unit_name_path_escape allows a local attacker, able to mount a filesystem on a very long path, to crash systemd and the whole system by allocating a very large space in the stack. A race condition vulnerability was found in Go. The incoming requests body weren't closed after the handler panic and as a consequence this could lead to ReverseProxy crash. The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. A vulnerability was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permi…

OESA-2022-1518 — golang security update

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP2: golang, openEuler:20.03-LTS-SP3: golang

The Go Programming Language. Security Fix(es): In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (Falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.(CVE-2021-39293)

openSUSE-SU-2021:1342-1 — Security update for go1.16

Security update for go1.16

RHSA-2021:4902 — Red Hat Security Advisory: ACS 3.67 security and enhancement update

civetweb: directory traversal when using the built-in example HTTP form-based file upload mechanism via the mg_handle_form_request API nodejs-axios: Regular expression denial of service in trim function nodejs-prismjs: ReDoS vulnerability nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet helm: information disclosure vulnerability golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)

SUSE-RU-2021:3315-1 — Recommended update for go1.17

Recommended update for go1.17

UBUNTU-CVE-2021-39293

Affected: Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:Pro:20.04:LTS: golang-1.16

WID-SEC-W-2023-2229 — Splunk Splunk Enterprise: Mehrere Schwachstellen

Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.