ALT-BU-2021-3786-1
Branch p9 update bulletin.
Closed vulnerabilities
BDU:2021-01056
Уязвимость функции языка программирования Go, связанная с неверными вычислениями, позволяющая нарушителю раскрыть защищаемую информацию и оказать воздействие на целостность защищаемой информации
BDU:2021-01105
Уязвимость реализации команды «go get» языка программирования Go, позволяющая нарушителю выполнить произвольный код
BDU:2021-02853
Уязвимость криптографических функций библиотеки средства разработки GoLang прикладного программного обеспечения Аврора Центр, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-24553
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
- openSUSE-SU-2020:1584
- openSUSE-SU-2020:1584
- openSUSE-SU-2020:1587
- openSUSE-SU-2020:1587
- http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html
- http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2020/Sep/5
- http://seclists.org/fulldisclosure/2020/Sep/5
- 20200902 [RT-SA-2020-004] Inconsistent Behavior of Go's CGI and FastCGI Transport May Lead to Cross-Site Scripting
- 20200902 [RT-SA-2020-004] Inconsistent Behavior of Go's CGI and FastCGI Transport May Lead to Cross-Site Scripting
- https://groups.google.com/forum/#%21topic/golang-announce/8wqlSbkLdPs
- https://groups.google.com/forum/#%21topic/golang-announce/8wqlSbkLdPs
- FEDORA-2020-741cfa13d0
- FEDORA-2020-741cfa13d0
- https://security.netapp.com/advisory/ntap-20200924-0003/
- https://security.netapp.com/advisory/ntap-20200924-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.redteam-pentesting.de/advisories/rt-sa-2020-004
- https://www.redteam-pentesting.de/advisories/rt-sa-2020-004
Modified: 2024-11-21
CVE-2020-28362
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
- https://groups.google.com/g/golang-nuts/c/c-ssaaS7RMI
- https://groups.google.com/g/golang-nuts/c/c-ssaaS7RMI
- [trafficcontrol-issues] 20201112 [GitHub] [trafficcontrol] zrhoffman opened a new pull request #5278: Update Go version to 1.15.5
- [trafficcontrol-issues] 20201112 [GitHub] [trafficcontrol] zrhoffman opened a new pull request #5278: Update Go version to 1.15.5
- FEDORA-2020-e971480183
- FEDORA-2020-e971480183
- FEDORA-2020-864922e78a
- FEDORA-2020-864922e78a
- https://security.netapp.com/advisory/ntap-20201202-0004/
- https://security.netapp.com/advisory/ntap-20201202-0004/
- https://www.arista.com/en/support/advisories-notices/security-advisories/12166-security-advisory-62
- https://www.arista.com/en/support/advisories-notices/security-advisories/12166-security-advisory-62
Modified: 2024-11-21
CVE-2020-28366
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
- https://go.dev/cl/269658
- https://go.dev/cl/269658
- https://go.dev/issue/42559
- https://go.dev/issue/42559
- https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292
- https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
- https://pkg.go.dev/vuln/GO-2022-0475
- https://pkg.go.dev/vuln/GO-2022-0475
Modified: 2024-11-21
CVE-2020-28367
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
- https://go.dev/cl/267277
- https://go.dev/cl/267277
- https://go.dev/issue/42556
- https://go.dev/issue/42556
- https://go.googlesource.com/go/+/da7aa86917811a571e6634b45a457f918b8e6561
- https://go.googlesource.com/go/+/da7aa86917811a571e6634b45a457f918b8e6561
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
- https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
- https://pkg.go.dev/vuln/GO-2022-0476
- https://pkg.go.dev/vuln/GO-2022-0476
Modified: 2024-11-21
CVE-2020-29510
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
- https://security.netapp.com/advisory/ntap-20210129-0006/
- https://security.netapp.com/advisory/ntap-20210129-0006/
Modified: 2024-11-21
CVE-2021-3114
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
- https://github.com/golang/go/commit/d95ca9138026cbe40e0857d76a81a16d03230871
- https://github.com/golang/go/commit/d95ca9138026cbe40e0857d76a81a16d03230871
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update
- FEDORA-2021-e435a8bb88
- FEDORA-2021-e435a8bb88
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20210219-0001/
- https://security.netapp.com/advisory/ntap-20210219-0001/
- DSA-4848
- DSA-4848
Modified: 2024-11-21
CVE-2021-3115
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
- https://blog.golang.org/path-security
- https://blog.golang.org/path-security
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- FEDORA-2021-e435a8bb88
- FEDORA-2021-e435a8bb88
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20210219-0001/
- https://security.netapp.com/advisory/ntap-20210219-0001/
Closed bugs
geary не работает с mail.ru