Search CVE reports
111 – 120 of 129 results
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../...
9 affected packages
golang-1.13, golang-1.14, golang-1.16, golang-1.17, golang-1.18...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.13 | — | — | Not affected | Not affected | Not affected |
| golang-1.14 | — | — | Not in release | Not affected | Not in release |
| golang-1.16 | — | — | Not in release | Not affected | Not affected |
| golang-1.17 | — | — | Not affected | Not in release | Not in release |
| golang-1.18 | — | — | Not affected | Not affected | Not affected |
| golang-1.8 | — | — | Not in release | Not in release | Not affected |
| golang-1.9 | — | — | Not in release | Not in release | Not affected |
| golang-1.10 | — | — | Not in release | Not in release | Not affected |
| golang-1.6 | — | — | Not in release | Not in release | Not in release |
Some fixes available 26 of 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
17 affected packages
golang-1.13, golang-1.14, golang-1.16, golang-1.17, golang-1.18...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.13 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.14 | — | — | Not in release | Vulnerable | Not in release |
| golang-1.16 | — | — | Not in release | Fixed | Fixed |
| golang-1.17 | — | — | Vulnerable | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.8 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.9 | — | — | Not in release | Not in release | Vulnerable |
| google-guest-agent | Fixed | Fixed | Fixed | Fixed | Needs evaluation |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| golang | — | — | Not in release | Not in release | Not in release |
| golang-1.10 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.6 | — | — | Not in release | Not in release | Not in release |
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
Some fixes available 10 of 19
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
11 affected packages
golang-1.16, golang-1.17, golang, golang-1.10, golang-1.13...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.16 | Not in release | Not in release | Not in release | Fixed | Fixed |
| golang-1.17 | Not in release | Not in release | Needs evaluation | Not in release | Not in release |
| golang | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.10 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | Not in release |
| golang-1.15 | — | — | — | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
Some fixes available 10 of 13
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
8 affected packages
golang-1.16, golang-1.13, golang-1.11, golang-1.15, golang-1.17...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.16 | Not in release | Not in release | Not in release | Fixed | Fixed |
| golang-1.13 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.11 | — | — | — | — | — |
| golang-1.15 | — | — | — | — | — |
| golang-1.17 | Not in release | Not in release | Vulnerable | — | — |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.7 | — | — | — | — | — |
| golang-1.8 | — | — | — | — | Not affected |
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when...
6 affected packages
golang-1.11, golang-1.15, golang-1.17, golang-1.18, golang-1.7, golang-1.8
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.11 | — | — | — | — | — |
| golang-1.15 | — | — | — | — | — |
| golang-1.17 | — | — | Not affected | — | — |
| golang-1.18 | — | — | Not affected | Not affected | Not affected |
| golang-1.7 | — | — | — | — | — |
| golang-1.8 | — | — | — | — | Not affected |
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
6 affected packages
golang-1.11, golang-1.15, golang-1.17, golang-1.18, golang-1.7, golang-1.8
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.11 | — | — | — | — | — |
| golang-1.15 | — | — | — | — | — |
| golang-1.17 | — | — | Not affected | — | — |
| golang-1.18 | — | — | Not affected | Not affected | Not affected |
| golang-1.7 | — | — | — | — | — |
| golang-1.8 | — | — | — | — | Not affected |
Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
6 affected packages
golang-1.11, golang-1.15, golang-1.17, golang-1.18, golang-1.7, golang-1.8
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.11 | — | — | — | — | — |
| golang-1.15 | — | — | — | — | — |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Not affected | Not affected | Not affected |
| golang-1.7 | — | — | — | — | — |
| golang-1.8 | — | — | — | — | Needs evaluation |
Some fixes available 6 of 19
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
11 affected packages
golang-1.16, golang-1.17, golang, golang-1.10, golang-1.13...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.16 | Not in release | Not in release | Not in release | Fixed | Fixed |
| golang-1.17 | Not in release | Not in release | Needs evaluation | Not in release | Not in release |
| golang | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.10 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Not affected | Not affected | Not affected |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | Not in release |
| golang-1.15 | — | — | — | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
Some fixes available 4 of 6
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
2 affected packages
golang-1.18, golang-1.17
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.
2 affected packages
golang-1.18, golang-1.17
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.18 | — | — | Not affected | Not affected | Not affected |
| golang-1.17 | — | — | Not affected | — | — |