VuXML ID | Description |
079b3641-c4bd-11eb-a22a-693f0544ae52 | go -- multiple vulnerabilities
The Go project reports:
The SetString and UnmarshalText methods of math/big.Rat may cause a
panic or an unrecoverable fatal error if passed inputs with very
large exponents.
ReverseProxy in net/http/httputil could be made to forward certain
hop-by-hop headers, including Connection. In case the target of the
ReverseProxy was itself a reverse proxy, this would let an attacker
drop arbitrary headers, including those set by the
ReverseProxy.Director.
The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr
functions in net, and their respective methods on the Resolver type
may return arbitrary values retrieved from DNS which do not follow
the established RFC 1035 rules for domain names. If these names are
used without further sanitization, for instance unsafely included in
HTML, they may allow for injection of unexpected content. Note that
LookupTXT may still return arbitrary values that could require
sanitization before further use.
The NewReader and OpenReader functions in archive/zip can cause a
panic or an unrecoverable fatal error when reading an archive that
claims to contain a large number of files, regardless of its actual
size.
Discovery 2021-05-01 Entry 2021-06-03 go
< 1.16.5,1
CVE-2021-33198
https://github.com/golang/go/issues/45910
CVE-2021-33197
https://github.com/golang/go/issues/46313
CVE-2021-33195
https://github.com/golang/go/issues/46241
CVE-2021-33196
https://github.com/golang/go/issues/46242
|
7f242313-aea5-11eb-8151-67f74cf7c704 | go -- net/http: ReadRequest can stack overflow due to recursion with very large headers
The Go project reports:
http.ReadRequest can stack overflow due to recursion when given a
request with a very large header (~8-10MB depending on the
architecture). A http.Server which overrides the default max header
of 1MB by setting Server.MaxHeaderBytes to a much larger value could
also be vulnerable in the same way.
Discovery 2021-04-22 Entry 2021-05-06 go
< 1.16.4,1
CVE-2021-31525
https://github.com/golang/go/issues/45710
|
c365536d-e3cf-11eb-9d8d-b37b683944c2 | go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters
The Go project reports:
crypto/tls clients can panic when provided a certificate of
the wrong type for the negotiated parameters. net/http clients
performing HTTPS requests are also affected. The panic can be
triggered by an attacker in a privileged network position
without access to the server certificate's private key, as
long as a trusted ECDSA or Ed25519 certificate for the server
exists (or can be issued), or the client is configured with
Config.InsecureSkipVerify. Clients that disable all TLS_RSA
cipher suites (that is, TLS 1.0âÂÂ1.2 cipher suites without
ECDHE), as well as TLS 1.3-only clients, are unaffected.
Discovery 2021-07-07 Entry 2021-07-12 go
< 1.16.6,1
CVE-2021-34558
https://github.com/golang/go/issues/47143
|
880552c4-f63f-11eb-9d56-7186043316e9 | go -- net/http: panic due to racy read of persistConn after handler panic
The Go project reports:
A net/http/httputil ReverseProxy can panic due to a race
condition if its Handler aborts with ErrAbortHandler, for
example due to an error in copying the response body. An
attacker might be able to force the conditions leading to
the race condition.
Discovery 2021-06-21 Entry 2021-08-05 go
< 1.16.7,1
CVE-2021-36221
https://github.com/golang/go/issues/46866
|
4fce9635-28c0-11ec-9ba8-002324b2fba8 | go -- misc/wasm, cmd/link: do not let command line arguments overwrite global data
The Go project reports:
When invoking functions from WASM modules, built using GOARCH=wasm
GOOS=js, passing very large arguments can cause portions of the module
to be overwritten with data from the arguments.
If using wasm_exec.js to execute WASM modules, users will need to
replace their copy after rebuilding any modules.
Discovery 2021-10-06 Entry 2021-10-09 go
< 1.17.2,1
CVE-2021-38297
https://github.com/golang/go/issues/48797
|
4ea1082a-1259-11ec-b4fa-dd5a552bdd17 | go -- archive/zip: overflow in preallocation check can cause OOM panic
The Go project reports:
An oversight in the previous fix still allows for an OOM
panic when the indicated directory size in the archive
header is so large that subtracting it from the archive
size overflows a uint64, effectively bypassing the check
that the number of files in the archive is reasonable.
Discovery 2021-08-18 Entry 2021-09-10 go
< 1.17.1,1
CVE-2021-39293
https://github.com/golang/go/issues/47801
|