Most recent entries from all

ALSA-2024:2562 — Important: golang security update

Affected: AlmaLinux:9: go-toolset, AlmaLinux:9: golang, AlmaLinux:9: golang-bin, AlmaLinux:9: golang-docs, AlmaLinux:9: golang-misc, AlmaLinux:9: golang-src, AlmaLinux:9: golang-tests

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289) * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783) * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784) * golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785) * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-04962

BELL-CVE-2024-24784

Affected: Alpaquita:23: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:stream: go

BIT-golang-2024-24784 — Comments in display names are incorrectly handled in net/mail

Affected: Bitnami: golang

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

certfr-2024-avi-0646 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0646

EUVD-2026-217242

fkie_cve-2024-24784

GHSA-fgq5-q76c-gx78

gsd-2024-24784

msrc_CVE-2024-24784 — Comments in display names are incorrectly handled in net/mail

msrc_CVE-2024-24784

OESA-2024-1432 — golang security update

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP4: golang, openEuler:22.03-LTS: golang, openEuler:22.03-LTS-SP1: golang, openEuler:22.03-LTS-SP2: golang, openEuler:22.03-LTS-SP3: golang

The Go Programming Language. Security Fix(es): The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.(CVE-2024-24784)

openSUSE-SU-2024:13752-1 — go1.22-1.22.1-1.1 on GA media

go1.22-1.22.1-1.1 on GA media

RHSA-2024:0041 — Red Hat Security Advisory: OpenShift Container Platform 4.16.0 bug fix and security update

helm: shows secrets with --dry-run option in clear text opentelemetry: DoS vulnerability in otelhttp golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics ssh: Prefix truncation attack on Binary Packet Protocol (BPP) go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients coredns: CD bit response is cached and served later quic-go: memory exhaustion attack against QUIC's connection ID mechanism golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm golang: net/mail: comments in display names are incorrectly handled golang: html/template: errors returned from MarshalJSON methods may break template escaping golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials jose: resource exhaustion jose-go: improper handling of highly compressed data follow-redirects: Possible credential leak webpack-dev-middleware: lack of URL validation may lead to file leak

SUSE-SU-2024:0800-1 — Security update for go1.21

Security update for go1.21

UBUNTU-CVE-2024-24784

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 12 more

WID-SEC-W-2024-0560 — Golang Go: Mehrere Schwachstellen

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um beliebigen Code auszuführen oder um Sicherheitsmaßnahmen zu umgehen.