Most recent entries from all

ALSA-2021:5160 — Important: go-toolset:rhel8 security and bug fix update

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: net/http: limit growth of header canonicalization cache (CVE-2021-44716)

* golang: syscall: don't close fd 0 on ForkExec error (CVE-2021-44717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Rebase Go to 1.16.12 (BZ#2031125)

Withdrawn: BELL-CVE-2021-44716 — CVE-2021-44716 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2021-44716

Affected: Bitnami: golang

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

certfr-2022-avi-097 — De multiples vulnérabilités ont été découvertes dans IBM Spectrum Protect Plus. Certaines d'entre elles permettent à un…

certfr-2022-avi-097

CLEANSTART-2026-FL12105 — Security fix for CVE-2021-44716 applied in: cfssl 1.5.0-r1

Affected: CleanStart: cfssl

Security vulnerability affects the cfssl package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-33064

fkie_cve-2021-44716

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

GHSA-vc3p-29h2-gpcp — golang.org/x/net/http2 allows uncontrolled memory consumption

Affected: Go: golang.org/x/net/http2

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

gsd-2021-44716

ICSA-23-047-04 — Siemens Brownfield Connectivity Gateway

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field. net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion. encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic. The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

msrc_CVE-2021-44716 — net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicaliz…

msrc_CVE-2021-44716

OESA-2022-1499 — golang security update

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP2: golang, openEuler:20.03-LTS-SP3: golang

The Go Programming Language. Security Fix(es): net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.(CVE-2021-44716)

openSUSE-SU-2021:1626-1 — Security update for go1.16

Security update for go1.16

RHEA-2022:1596 — Red Hat Enhancement Advisory: OpenShift Virtualization 4.9.4 Images

golang: net/http/httputil: panic due to racy read of persistConn after handler panic golang: net/http: limit growth of header canonicalization cache golang: syscall: don't close fd 0 on ForkExec error

SUSE-SU-2021:4169-1 — Security update for go1.16

Security update for go1.16

UBUNTU-CVE-2021-44716

Affected: Ubuntu:Pro:16.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:16.04:LTS: google-guest-agent, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:Pro:18.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:18.04:LTS: google-guest-agent, Ubuntu:20.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: golang-golang-x-net-dev, Ubuntu:22.04:LTS: golang-1.17, Ubuntu:22.04:LTS: google-guest-agent

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

WID-SEC-W-2022-0510 — IBM DB2: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, willkürlichen Code mit erhöhten Rechten auszuführen, Informationen falsch darzustellen und beliebigen Code auszuführen.