ALT-BU-2021-3954-1
Branch c9f2 update bulletin.
Closed vulnerabilities
BDU:2021-01056
Уязвимость функции языка программирования Go, связанная с неверными вычислениями, позволяющая нарушителю раскрыть защищаемую информацию и оказать воздействие на целостность защищаемой информации
BDU:2021-01105
Уязвимость реализации команды «go get» языка программирования Go, позволяющая нарушителю выполнить произвольный код
BDU:2022-00723
Уязвимость компонента math/big.Rat и метода unmarshaltext языка программирования Go, позволяющая нарушителю вызвать аварийный сбой и перезапуск устройства
BDU:2022-01685
Уязвимость компонента archive/zip языка программирования Golang, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01781
Уязвимость компонента net/http/httputil языка программирования Golang, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-01783
Уязвимость функций net.Lookup{Addr,CNAME,Host} языка программирования Golang, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-29510
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
- https://security.netapp.com/advisory/ntap-20210129-0006/
- https://security.netapp.com/advisory/ntap-20210129-0006/
Modified: 2024-11-21
CVE-2021-27918
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
Modified: 2024-11-21
CVE-2021-27919
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
Modified: 2024-11-21
CVE-2021-3114
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
- https://github.com/golang/go/commit/d95ca9138026cbe40e0857d76a81a16d03230871
- https://github.com/golang/go/commit/d95ca9138026cbe40e0857d76a81a16d03230871
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update
- FEDORA-2021-e435a8bb88
- FEDORA-2021-e435a8bb88
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20210219-0001/
- https://security.netapp.com/advisory/ntap-20210219-0001/
- DSA-4848
- DSA-4848
Modified: 2024-11-21
CVE-2021-3115
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
- https://blog.golang.org/path-security
- https://blog.golang.org/path-security
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- FEDORA-2021-e435a8bb88
- FEDORA-2021-e435a8bb88
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20210219-0001/
- https://security.netapp.com/advisory/ntap-20210219-0001/
Modified: 2024-11-21
CVE-2021-31525
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
Modified: 2024-11-21
CVE-2021-33194
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
- https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7
- https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7
- https://groups.google.com/g/golang-announce/c/wPunbCPkWUg
- https://groups.google.com/g/golang-announce/c/wPunbCPkWUg
- FEDORA-2022-17d004ed71
- FEDORA-2022-17d004ed71
Modified: 2024-11-21
CVE-2021-33195
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
- https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20210902-0005/
- https://security.netapp.com/advisory/ntap-20210902-0005/
Modified: 2024-11-21
CVE-2021-33196
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
- https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
- [debian-lts-announce] 20220121 [SECURITY] [DLA 2891-1] golang-1.8 security update
- [debian-lts-announce] 20220121 [SECURITY] [DLA 2891-1] golang-1.8 security update
- [debian-lts-announce] 20220121 [SECURITY] [DLA 2892-1] golang-1.7 security update
- [debian-lts-announce] 20220121 [SECURITY] [DLA 2892-1] golang-1.7 security update
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update
- GLSA-202208-02
- GLSA-202208-02
Modified: 2024-11-21
CVE-2021-33197
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
Modified: 2024-11-21
CVE-2021-33198
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.