2022-03-06
ALT-BU-2022-4209-1
Branch c9f2 update bulletin.
Closed vulnerabilities
Published: 2022-01-20
BDU:2022-03899
Уязвимость реализации функции SetString() класса Rat пакета math/big языка программирования Go, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2022-02-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-23772
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2985-1] golang-1.7 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2985-1] golang-1.7 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2986-1] golang-1.8 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2986-1] golang-1.8 security update
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20220225-0006/
- https://security.netapp.com/advisory/ntap-20220225-0006/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Published: 2022-02-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-23773
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20220225-0006/
- https://security.netapp.com/advisory/ntap-20220225-0006/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Published: 2022-02-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-23806
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
Severity: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References:
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2985-1] golang-1.7 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2985-1] golang-1.7 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2986-1] golang-1.8 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2986-1] golang-1.8 security update
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20220225-0006/
- https://security.netapp.com/advisory/ntap-20220225-0006/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Published: 2022-03-05
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-24921
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
- https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
- https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2985-1] golang-1.7 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2985-1] golang-1.7 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2986-1] golang-1.8 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2986-1] golang-1.8 security update
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update
- GLSA-202208-02
- GLSA-202208-02
- https://security.netapp.com/advisory/ntap-20220325-0010/
- https://security.netapp.com/advisory/ntap-20220325-0010/