https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:55:38 +0000 https://cve.radiocsirt.org/vuln/cve-2025-61732 <p><strong>Affected:</strong> Go toolchain cmd/cgo, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions and 23 more</p> <p>A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.</p> <p><strong>Affected:</strong> Go toolchain cmd/cgo, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions and 23 more</p> <p>A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.</p> https://cve.radiocsirt.org/vuln/cve-2025-61732 https://cve.radiocsirt.org/vuln/ghsa-273p-m2cw-6833 <p><strong>Affected:</strong> Go: github.com/sigstore/rekor</p> <p>## Summary</p> <p>Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`.</p> <p>## Impact</p> <p>A malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.</p> <p>## Patches</p> <p>Upgrade to v1.5.0</p> <p>## Workarounds</p> <p>None</p> <p><strong>Affected:</strong> Go: github.com/sigstore/rekor</p> <p>## Summary</p> <p>Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`.</p> <p>## Impact</p> <p>A malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.</p> <p>## Patches</p> <p>Upgrade to v1.5.0</p> <p>## Workarounds</p> <p>None</p> https://cve.radiocsirt.org/vuln/ghsa-273p-m2cw-6833