Most recent entries from all

ALSA-2022:7129 — Moderate: git-lfs security and bug fix update

Affected: AlmaLinux:8: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851) * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* git-lfs needs to be rebuild with golang 1.17.7-1 or above

bdu:2022-05544

Withdrawn: BELL-CVE-2022-27664 — CVE-2022-27664 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2022-27664

Affected: Bitnami: golang

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

certfr-2022-avi-1040 — De multiples vulnérabilités ont été découvertes dans IBM Spectrum Protect. Certaines d'entre elles permettent à un atta…

certfr-2022-avi-1040

CLEANSTART-2024-OB04829 — In net/http in Go before 1

Affected: CleanStart: docker-cli-compose

Security vulnerability affects the docker-cli-compose package. In net/http in Go before 1.

EUVD-2026-15404

fkie_cve-2022-27664

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

GHSA-69cg-p879-7622 — golang.org/x/net/http2 Denial of Service vulnerability

Affected: Go: golang.org/x/net, Go: golang.org/x/net/http2

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

gsd-2022-27664

msrc_CVE-2022-27664 — In net/http in Go before 1.18.6 and 1.19.x before 1.19.1 attackers can cause a denial of service because an HTTP/2 conn…

msrc_CVE-2022-27664

OESA-2022-1939 — golang security update

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP3: golang, openEuler:22.03-LTS: golang

The Go Programming Language Security Fix(es): In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.(CVE-2022-27664)

openSUSE-SU-2024:12309-1 — go1.18-1.18.6-1.1 on GA media

go1.18-1.18.6-1.1 on GA media

RHBA-2023:0564 — Red Hat Bug Fix Advisory: OpenShift Container Platform 4.11.26 packages update

golang: net/http: handle server errors after sending GOAWAY

SUSE-EL-9-CLIENT-TOOLS-2023-2185 — Security update for SUSE Manager Client Tools

Security update for SUSE Manager Client Tools

UBUNTU-CVE-2022-27664

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:16.04:LTS: juju-core, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: google-guest-agent, Ubuntu:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10 and 19 more

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

WID-SEC-W-2022-2134 — IBM Spectrum Protect: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift ausnutzen, um einen Cross site Scripting Angriff durchzuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.