Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 254

Export CSV
CVE-2021-3121

gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS 3.1 · 8.6 High EPSS 3.4% KEV · Not listed
Vendors
Golang Hashicorp Redhat
Products
Protobuf Consul Acm and 6 more
CVE-2021-3115

golang: cmd/go: packages using cgo can cause arbitrary code execution at build time

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

CVSS 3.1 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Fedoraproject Golang Microsoft and 2 more
Products
Fedora Go Windows and 4 more
CVE-2021-3114

golang: crypto/elliptic: incorrect operations on the P-224 curve

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 2 more
Products
Debian Linux Fedora Go and 10 more
CVE-2021-39293

golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

CVSS 3.1 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Cloud Insights Telegraf Advanced Cluster Security and 4 more
CVE-2021-38297

golang: Command-line arguments may overwrite global data

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

CVSS 3.1 · 9.8 Critical EPSS 11.0% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Enterprise Linux and 1 more
CVE-2021-36221

golang: net/http/httputil: panic due to racy read of persistConn after handler panic

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

CVSS 3.1 · 5.9 Medium EPSS 3.1% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 3 more
Products
Debian Linux Fedora Go and 12 more
CVE-2021-34558

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

CVSS 3.1 · 6.5 Medium EPSS 7.0% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 2 more
Products
Fedora Go Cloud Insights Telegraf and 16 more
CVE-2021-33197

golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

CVSS 3.1 · 5.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Golang Redhat
Products
Go Advanced Cluster Security Container Native Virtualization and 8 more
CVE-2021-33196

golang: archive/zip: malformed archive may cause panic or memory exhaustion

In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Debian Golang Redhat
Products
Debian Linux Go Devtools and 5 more
CVE-2021-33195

golang: net: lookup functions may return invalid host names

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

CVSS 3.1 · 7.3 High EPSS 3.2% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Cloud Insights Telegraf Agent Advanced Cluster Security and 9 more
CVE-2021-33194

golang: x/net/html: infinite loop in ParseFragment

golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.

CVSS 3.1 · 7.5 High EPSS 7.5% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Logging and 1 more
CVE-2021-31525

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

CVSS 3.1 · 5.9 Medium EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Advanced Cluster Security and 8 more
CVE-2021-29923

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Golang Oracle and 1 more
Products
Fedora Go Timesten In-memory Database and 10 more
CVE-2021-27919

golang: archive/zip: panic when calling Reader.Open

archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Golang
Products
Fedora Go
CVE-2021-27918

golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Golang Redhat
Products
Go Enterprise Linux Openshift Container Storage and 1 more
CVE-2021-23772

Arbitrary File Write

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Golang Iris-go
Products
Go Iris
CVE-2020-9283

golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

CVSS 3.1 · 7.5 High EPSS 21.1% KEV · Not listed
Vendors
Debian Golang Redhat
Products
Debian Linux Package Ssh 3scale Amp and 4 more
CVE-2020-7919

golang: Integer overflow on 32bit architectures via crafted certificate allows for denial of service

Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 1 more
Products
Debian Linux Fedora Go and 1 more
CVE-2020-29652

golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Golang Redhat
Products
Ssh Container Native Virtualization Enterprise Linux and 1 more