In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
Max CVSS
6.5
EPSS Score
1.44%
Published
2021-01-26
Updated
2022-09-14
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
Max CVSS
7.5
EPSS Score
1.72%
Published
2021-01-26
Updated
2022-09-14
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
Max CVSS
7.5
EPSS Score
0.09%
Published
2021-03-11
Updated
2022-12-13
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
Max CVSS
5.5
EPSS Score
0.07%
Published
2021-03-11
Updated
2022-12-13
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
Max CVSS
7.5
EPSS Score
0.23%
Published
2021-08-07
Updated
2022-09-14
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
Max CVSS
5.9
EPSS Score
0.85%
Published
2021-05-27
Updated
2022-11-09
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
Max CVSS
7.5
EPSS Score
0.50%
Published
2021-08-02
Updated
2022-09-14
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
Max CVSS
7.5
EPSS Score
0.18%
Published
2021-08-02
Updated
2023-04-20
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
Max CVSS
5.3
EPSS Score
0.14%
Published
2021-08-02
Updated
2022-09-14
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
Max CVSS
7.5
EPSS Score
0.24%
Published
2021-08-02
Updated
2022-09-14
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
Max CVSS
6.5
EPSS Score
0.26%
Published
2021-07-15
Updated
2022-08-04
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
Max CVSS
5.9
EPSS Score
0.71%
Published
2021-08-08
Updated
2023-04-20
Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.
Max CVSS
9.8
EPSS Score
0.44%
Published
2021-10-18
Updated
2023-04-20
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
Max CVSS
7.5
EPSS Score
0.41%
Published
2021-11-08
Updated
2023-04-20
Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.
Max CVSS
7.5
EPSS Score
0.26%
Published
2021-11-08
Updated
2023-02-14
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
Max CVSS
7.5
EPSS Score
0.30%
Published
2022-01-01
Updated
2023-04-20
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
Max CVSS
5.8
EPSS Score
0.28%
Published
2022-01-01
Updated
2023-04-20
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
Max CVSS
7.8
EPSS Score
0.37%
Published
2022-02-11
Updated
2022-11-09
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
Max CVSS
7.5
EPSS Score
0.08%
Published
2022-02-11
Updated
2022-11-09
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
Max CVSS
9.1
EPSS Score
0.34%
Published
2022-02-11
Updated
2023-04-20
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!