p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости golang-1.10 · Страница 6

За последние 30 дней в golang-1.10 опубликовано уязвимостей: 17; в каталоге KEV: 0.

Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 141

  1. CVE-2023-24536

    Высокий · CVSS 7.5EPSS 1,48%Нет опубликованного исправления

    Excessive resource consumption in net/http, net/textproto and mime/multipart

    Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combi

    Опубликовано Обновлено
  2. CVE-2023-24532

    Средний · CVSS 5.3EPSS 0,82%Нет опубликованного исправления

    Incorrect calculation on P256 curves in crypto/internal/nistec

    The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.

    Опубликовано Обновлено
  3. CVE-2022-41723

    Высокий · CVSS 7.5EPSS 4,56%Нет опубликованного исправления

    Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

    A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

  4. CVE-2022-41725

    Высокий · CVSS 7.5EPSS 1,24%Нет опубликованного исправления

    Excessive resource consumption in mime/multipart

    A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively

    Опубликовано Обновлено
  5. CVE-2022-41717

    Средний · CVSS 5.3EPSS 6,08%Нет опубликованного исправления

    Excessive memory growth in net/http and golang.org/x/net/http2

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

    Опубликовано Обновлено
  6. CVE-2022-41716

    Средний · CVSS 6.3EPSS 1,03%Нет опубликованного исправления

    Unsanitized NUL in environment variables on Windows in syscall and os/exec

    Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

    Опубликовано Обновлено
  7. CVE-2022-41715

    Высокий · CVSS 7.5EPSS 1,73%Нет опубликованного исправления

    Memory exhaustion when compiling regular expressions in regexp/syntax

    Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

    Опубликовано Обновлено
  8. CVE-2022-2880

    Высокий · CVSS 7.5EPSS 1,41%Нет опубликованного исправления

    Incorrect sanitization of forwarded query parameters in net/http/httputil

    Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.

    Опубликовано Обновлено
  9. CVE-2022-2879

    Высокий · CVSS 7.5EPSS 2,01%Нет опубликованного исправления

    Unbounded memory consumption when reading headers in archive/tar

    Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

    Опубликовано Обновлено
  10. CVE-2022-27664

    Высокий · CVSS 7.5EPSS 3,27%Нет опубликованного исправления

    CVE-2022-27664

    In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

    Опубликовано Обновлено
  11. CVE-2022-32189

    Высокий · CVSS 7.5EPSS 2,78%Нет опубликованного исправления

    Panic when decoding Float and Rat types in math/big

    A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

    Опубликовано Обновлено
  12. CVE-2022-29526

    Средний · CVSS 5.3EPSS 2,95%Нет опубликованного исправления

    CVE-2022-29526

    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

  13. CVE-2022-23773

    Высокий · CVSS 7.5EPSS 2,68%Нет опубликованного исправления

    CVE-2022-23773

    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

    Опубликовано Обновлено
  14. CVE-2022-23772

    Высокий · CVSS 7.5EPSS 2,81%Нет опубликованного исправления

    CVE-2022-23772

    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

    Опубликовано Обновлено
  15. CVE-2021-38297

    Критический · CVSS 9.8EPSS 10,96%Нет опубликованного исправления

    CVE-2021-38297

    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

    Опубликовано Обновлено
  16. CVE-2021-36221

    Средний · CVSS 5.9EPSS 3,11%Нет опубликованного исправления

    CVE-2021-36221

    Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

    Опубликовано Обновлено
  17. CVE-2021-29923

    Высокий · CVSS 7.5EPSS 3,74%Нет опубликованного исправления

    CVE-2021-29923

    Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

    Опубликовано Обновлено
  18. CVE-2021-34558

    Средний · CVSS 6.5EPSS 6,98%Нет опубликованного исправления

    CVE-2021-34558

    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

  19. CVE-2021-27919

    Средний · CVSS 5.5EPSS 1,52%Нет опубликованного исправления

    CVE-2021-27919

    archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.

    Опубликовано Обновлено

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →