Search CVE reports

61 – 70 of 73 results

Detailed view

Sort by:

CVE-2022-2879

Medium priority

Some fixes available 10 of 18

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After...

10 affected packages

golang-1.19, golang-1.18, golang-1.17, golang-1.13, golang-1.16...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.19	Not in release	Not in release	Not in release	Not in release
golang-1.18	Not in release	Fixed	Fixed	Fixed
golang-1.17	—	Vulnerable	Not in release	Not in release
golang-1.13	Not in release	Fixed	Fixed	Fixed
golang-1.16	Not in release	Not in release	Fixed	Fixed
golang-1.10	Not in release	Not in release	Not in release	Vulnerable
golang-1.14	Not in release	Not in release	Vulnerable	Not in release
golang-1.6	Not in release	Not in release	Not in release	Not in release
golang-1.8	Not in release	Not in release	Not in release	Vulnerable
golang-1.9	Not in release	Not in release	Not in release	Vulnerable

CVE-2022-28327

Medium priority

Some fixes available 4 of 6

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

2 affected packages

golang-1.17, golang-1.18

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.17	Not in release	Needs evaluation	—	—
golang-1.18	Not in release	Fixed	Fixed	Fixed

CVE-2022-27664

Medium priority

Some fixes available 16 of 33

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

14 affected packages

golang-1.13, golang-1.14, golang-1.16, golang-1.17, golang-1.18...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.13	Not in release	Fixed	Fixed	Fixed
golang-1.14	—	Not in release	Vulnerable	Not in release
golang-1.16	—	Not in release	Fixed	Fixed
golang-1.17	—	Vulnerable	Not in release	Not in release
golang-1.18	Not in release	Fixed	Fixed	Fixed
golang-1.6	—	Not in release	Not in release	Not in release
golang-1.8	—	Not in release	Not in release	Vulnerable
golang-1.9	—	Not in release	Not in release	Vulnerable
golang	—	Not in release	Not in release	Not in release
golang-1.10	—	Not in release	Not in release	Vulnerable
golang-golang-x-net	Not affected	Vulnerable	Not in release	Not in release
google-guest-agent	Fixed	Fixed	Fixed	Needs evaluation
containerd	Not affected	Not affected	Not affected	Not affected
golang-golang-x-net-dev	Not in release	Not in release	Needs evaluation	Needs evaluation

CVE-2022-27536

Medium priority

Ignored

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

2 affected packages

golang-1.17, golang-1.18

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.17	—	Not affected	—	—
golang-1.18	—	Not affected	Not in release	Not affected

CVE-2022-24921

Low priority

Needs evaluation

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

9 affected packages

golang-1.6, golang-1.10, golang-1.13, golang-1.15, golang-1.14...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.6	—	—	—	—
golang-1.10	—	—	—	Needs evaluation
golang-1.13	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
golang-1.15	—	—	—	—
golang-1.14	—	—	Needs evaluation	—
golang-1.16	Not in release	Not in release	Needs evaluation	Needs evaluation
golang-1.17	Not in release	Needs evaluation	—	—
golang-1.8	—	—	—	Needs evaluation
golang-1.9	—	—	—	Needs evaluation

CVE-2022-24675

Medium priority

Some fixes available 4 of 6

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

2 affected packages

golang-1.17, golang-1.18

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.17	Not in release	Needs evaluation	—	—
golang-1.18	Not in release	Fixed	Fixed	Fixed

CVE-2022-23773

Medium priority

Needs evaluation

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

10 affected packages

golang-1.13, golang, golang-1.10, golang-1.14, golang-1.15...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.13	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
golang	Not in release	Not in release	Not in release	Not in release
golang-1.10	Not in release	Not in release	Not in release	Needs evaluation
golang-1.14	Not in release	Not in release	Needs evaluation	Not in release
golang-1.15	—	—	Not in release	Not in release
golang-1.16	Not in release	Not in release	Needs evaluation	Needs evaluation
golang-1.17	Not in release	Needs evaluation	Not in release	Not in release
golang-1.6	Not in release	Not in release	Not in release	Not in release
golang-1.8	Not in release	Not in release	Not in release	Needs evaluation
golang-1.9	Not in release	Not in release	Not in release	Needs evaluation

CVE-2022-23772

Medium priority

Needs evaluation

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

10 affected packages

golang, golang-1.6, golang-1.8, golang-1.9, golang-1.10...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang	Not in release	Not in release	Not in release	Not in release
golang-1.6	Not in release	Not in release	Not in release	Not in release
golang-1.8	Not in release	Not in release	Not in release	Needs evaluation
golang-1.9	Not in release	Not in release	Not in release	Needs evaluation
golang-1.10	Not in release	Not in release	Not in release	Needs evaluation
golang-1.13	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
golang-1.14	Not in release	Not in release	Needs evaluation	Not in release
golang-1.15	—	—	Not in release	Not in release
golang-1.16	Not in release	Not in release	Needs evaluation	Needs evaluation
golang-1.17	Not in release	Needs evaluation	Not in release	Not in release

CVE-2021-44717

Medium priority

Vulnerable

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

5 affected packages

golang-1.15, golang-1.17, golang-1.7, golang-1.8, golang-1.11

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.15	—	—	Not in release	Not in release
golang-1.17	Not in release	Vulnerable	Not in release	Not in release
golang-1.7	Not in release	Not in release	Not in release	Not in release
golang-1.8	Not in release	Not in release	Not in release	Vulnerable
golang-1.11	Not in release	Not in release	Not in release	Not in release

CVE-2021-44716

Medium priority

Some fixes available 6 of 22

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

8 affected packages

golang-1.11, golang-1.17, golang-1.7, golang-1.8, golang-golang-x-net...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
golang-1.11	Not in release	Not in release	Not in release	Not in release
golang-1.17	Not in release	Vulnerable	Not in release	Not in release
golang-1.7	Not in release	Not in release	Not in release	Not in release
golang-1.8	Not in release	Not in release	Not in release	Vulnerable
golang-golang-x-net	Not affected	Not affected	Not in release	Not in release
golang-golang-x-net-dev	Not in release	Not in release	Vulnerable	Vulnerable
google-guest-agent	Fixed	Fixed	Fixed	Vulnerable
golang-1.15	—	—	Not in release	Not in release

Export to JSON

Results by page: