Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2020-1700

ceph: connection leak in the RGW Beast front-end permits a DoS against the RGW server

A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Ceph Opensuse and 1 more
Products
Ubuntu Linux Ceph Leap and 1 more
CVE-2020-16845

golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 2 more
Products
Debian Linux Fedora Go and 10 more
CVE-2020-15586

golang: data race in certain net/http servers including ReverseProxy can lead to DoS

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Cloudfoundry Debian Fedoraproject and 3 more
Products
Cf-deployment Routing-release Debian Linux and 12 more
CVE-2020-14040

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Text 3scale Amp and 13 more