Most recent entries from all

ALSA-2025:0401 — Important: grafana security update

Affected: AlmaLinux:8: grafana, AlmaLinux:8: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* go-git: argument injection via the URL field (CVE-2025-21613) * go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-00211

certfr-2025-avi-0337 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0337

EUVD-2026-250837

fkie_cve-2025-21614

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

GHSA-r9px-m959-cxf4 — go-git clients vulnerable to DoS via maliciously crafted Git server replies

Affected: Go: gopkg.in/src-d/go-git.v4, Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git

### Impact A denial of service (DoS) vulnerability was discovered in go-git versions prior to `v5.13`. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in `go-git` clients.

This is a `go-git` implementation issue and does not affect the upstream `git` cli.

### Patches Users running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.13` in order to mitigate this vulnerability.

### Workarounds In cases where a bump to the latest version of `go-git` is not possible, we recommend limiting its use to only trust-worthy Git servers.

## Credit Thanks to Ionut Lalu for responsibly disclosing this vulnerability to us.

msrc_CVE-2025-21614 — go-git clients vulnerable to DoS via maliciously crafted Git server replies

msrc_CVE-2025-21614

openSUSE-SU-2025:0056-1 — Security update for trivy

Security update for trivy

RHSA-2024:6121 — Red Hat Security Advisory: OpenShift Container Platform 4.18.1 security and extras update

helm: shows secrets with --dry-run option in clear text PostCSS: Improper input validation in PostCSS cross-spawn: regular expression denial of service golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html body-parser: Denial of Service Vulnerability in body-parser dompurify: DOMPurify vulnerable to tampering by prototype pollution path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x nanoid: nanoid mishandles non-integer values jinja2: Jinja has a sandbox breakout through malicious filenames jinja2: Jinja has a sandbox breakout through indirect reference to format method go-git: argument injection via the URL field go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies

SUSE-SU-2025:0060-1 — Security update for govulncheck-vulndb

Security update for govulncheck-vulndb

UBUNTU-CVE-2025-21614

Affected: Ubuntu:Pro:22.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:24.04:LTS: golang-github-go-git-go-git

WID-SEC-W-2025-0123 — Red Hat Enterprise Linux und and OpenShift (go-git): Mehrere Schwachstellen

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Grafana Komponente ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.