FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-18 11:12:36 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
61bce714-ca0c-11ec-9cfc-10c37b4ac2ea	go -- multiple vulnerabilities The Go project reports: encoding/pem: fix stack overflow in Decode. A large (more than 5 MB) PEM input can cause a stack overflow in Decode, leading the program to crash. crypto/elliptic: tolerate all oversized scalars in generic P-256. A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected. crypto/x509: non-compliant certificates can cause a panic in Verify on macOS in Go 1.18. Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS. These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash. Discovery 2022-04-12 Entry 2022-05-02 go < 1.18.1,1 go117 < 1.17.9 CVE-2022-24675 https://github.com/golang/go/issues/51853 CVE-2022-28327 https://github.com/golang/go/issues/52075 CVE-2022-27536 https://github.com/golang/go/issues/51759
a1360138-d446-11ec-8ea1-10c37b4ac2ea	go -- syscall.Faccessat checks wrong group on Linux The Go project reports: When called with a non-zero flags parameter, the syscall.Faccessat function could incorrectly report that a file is accessible. This bug only occurs on Linux systems. Discovery 2022-04-12 Entry 2022-05-15 go < 1.18.2,1 go117 < 1.17.10 CVE-2022-29526 https://github.com/golang/go/issues/52313 https://groups.google.com/g/golang-dev/c/CPU3TB6d4oY
e2af876f-a7c8-11ec-9a2a-002324b2fba8	go -- multiple vulnerabilities The Go project reports: regexp: stack exhaustion compiling deeply nested expressions On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB. Discovery 2022-02-09 Entry 2022-03-19 go < 1.17.8,1 CVE-2022-24921 https://github.com/golang/go/issues/51112

VuXML ID

Description

61bce714-ca0c-11ec-9cfc-10c37b4ac2ea

go -- multiple vulnerabilities

The Go project reports:

encoding/pem: fix stack overflow in Decode.

A large (more than 5 MB) PEM input can cause a stack overflow in Decode, leading the program to crash.

crypto/elliptic: tolerate all oversized scalars in generic P-256.

A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected.

crypto/x509: non-compliant certificates can cause a panic in Verify on macOS in Go 1.18.

Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS. These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash.

Discovery 2022-04-12
Entry 2022-05-02
go

< 1.18.1,1

go117

< 1.17.9

CVE-2022-24675
https://github.com/golang/go/issues/51853
CVE-2022-28327
https://github.com/golang/go/issues/52075
CVE-2022-27536
https://github.com/golang/go/issues/51759

a1360138-d446-11ec-8ea1-10c37b4ac2ea

go -- syscall.Faccessat checks wrong group on Linux

The Go project reports:

When called with a non-zero flags parameter, the syscall.Faccessat function could incorrectly report that a file is accessible. This bug only occurs on Linux systems.

Discovery 2022-04-12
Entry 2022-05-15
go

< 1.18.2,1

go117

< 1.17.10

CVE-2022-29526
https://github.com/golang/go/issues/52313
https://groups.google.com/g/golang-dev/c/CPU3TB6d4oY

e2af876f-a7c8-11ec-9a2a-002324b2fba8

go -- multiple vulnerabilities

The Go project reports:

regexp: stack exhaustion compiling deeply nested expressions

On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB.

Discovery 2022-02-09
Entry 2022-03-19
go

< 1.17.8,1

CVE-2022-24921
https://github.com/golang/go/issues/51112