ALT-PU-2022-1265-2

Package golang updated to version 1.17.7-alt1 for branch sisyphus in task 295238.

Уязвимость реализации функции SetString() класса Rat пакета math/big языка программирования Go, позволяющая нарушителю вызвать отказ в обслуживании

Severity: HIGH (7.5)Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

References:

CVE-2022-23772

Уязвимость компонента Curve.IsOnCurve языка программирования Golang, позволяющая нарушителю оказывать влияние на доступность и целостность ресурса

Severity: CRITICAL (9.1)Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Severity: CRITICAL (9.4)Vector: AV:N/AC:L/Au:N/C:N/I:C/A:C

References:

CVE-2022-23806

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: HIGH (7.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: HIGH (7.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

Severity: MEDIUM (6.4)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P

Severity: CRITICAL (9.1)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References:

Version: 2.1.2

Package golang update in sisyphus on 2022-02-11

ALT-PU-2022-1265-2

Closed vulnerabilities

BDU:2022-03899

BDU:2024-10793

CVE-2022-23772

CVE-2022-23773

CVE-2022-23806