https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:53:28 +0000 https://cve.radiocsirt.org/vuln/cve-2025-0913 <p><strong>Affected:</strong> Go standard library syscall, Go standard library os</p> <p>os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.</p> <p><strong>Affected:</strong> Go standard library syscall, Go standard library os</p> <p>os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.</p> https://cve.radiocsirt.org/vuln/cve-2025-0913 https://cve.radiocsirt.org/vuln/ghsa-273p-m2cw-6833 <p><strong>Affected:</strong> Go: github.com/sigstore/rekor</p> <p>## Summary</p> <p>Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`.</p> <p>## Impact</p> <p>A malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.</p> <p>## Patches</p> <p>Upgrade to v1.5.0</p> <p>## Workarounds</p> <p>None</p> <p><strong>Affected:</strong> Go: github.com/sigstore/rekor</p> <p>## Summary</p> <p>Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`.</p> <p>## Impact</p> <p>A malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.</p> <p>## Patches</p> <p>Upgrade to v1.5.0</p> <p>## Workarounds</p> <p>None</p> https://cve.radiocsirt.org/vuln/ghsa-273p-m2cw-6833