Search CVE reports
41 – 50 of 84 results
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
11 affected packages
golang-1.10, golang-1.13, golang-1.14, golang-1.16, golang-1.17...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can...
16 affected packages
golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.10 | Not in release | Not in release | Not in release | — | Not affected |
| golang-1.13 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.14 | Not in release | Not in release | Not in release | Vulnerable | — |
| golang-1.16 | Not in release | Not in release | Not in release | Vulnerable | Vulnerable |
| golang-1.17 | Not in release | Not in release | Vulnerable | — | — |
| golang-1.18 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.20 | Not in release | Not in release | Vulnerable | Vulnerable | — |
| golang-1.21 | Not in release | Vulnerable | Vulnerable | Vulnerable | — |
| golang-1.22 | Not in release | Vulnerable | Vulnerable | Vulnerable | — |
| golang-1.23 | Vulnerable | Vulnerable | Vulnerable | — | — |
| golang-1.24 | Not affected | Vulnerable | Vulnerable | — | — |
| golang-1.25 | Not affected | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Not affected |
| golang-1.9 | Not in release | Not in release | Not in release | — | Not affected |
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is...
11 affected packages
golang-1.10, golang-1.13, golang-1.14, golang-1.16, golang-1.17...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.10 | Not in release | Not in release | Not in release | — | Vulnerable |
| golang-1.13 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.14 | Not in release | Not in release | Not in release | Vulnerable | — |
| golang-1.16 | Not in release | Not in release | Not in release | Vulnerable | Vulnerable |
| golang-1.17 | Not in release | Not in release | Vulnerable | — | — |
| golang-1.18 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.20 | Not in release | Not in release | Vulnerable | Vulnerable | — |
| golang-1.21 | Not in release | Vulnerable | Vulnerable | Vulnerable | — |
| golang-1.22 | Not in release | Vulnerable | Vulnerable | Vulnerable | — |
| golang-1.23 | Vulnerable | Vulnerable | Vulnerable | — | — |
| golang-1.24 | Vulnerable | Needs evaluation | Needs evaluation | — | — |
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one...
16 affected packages
golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.10 | Not in release | Not in release | Not in release | — | Not affected |
| golang-1.13 | Not in release | Not in release | Not affected | Not affected | Not affected |
| golang-1.14 | Not in release | Not in release | Not in release | Not affected | — |
| golang-1.16 | Not in release | Not in release | Not in release | Not affected | Not affected |
| golang-1.17 | Not in release | Not in release | Not affected | — | — |
| golang-1.18 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.20 | Not in release | Not in release | Vulnerable | Vulnerable | — |
| golang-1.21 | Not in release | Vulnerable | Vulnerable | Vulnerable | — |
| golang-1.22 | Not in release | Vulnerable | Vulnerable | Vulnerable | — |
| golang-1.23 | Vulnerable | Vulnerable | Vulnerable | — | — |
| golang-1.24 | Not affected | Vulnerable | Vulnerable | — | — |
| golang-1.25 | Not affected | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Not affected |
| golang-1.9 | Not in release | Not in release | Not in release | — | Not affected |
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when...
15 affected packages
golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.10 | Not in release | Not in release | Not in release | — | Ignored |
| golang-1.13 | Not in release | Not in release | Ignored | Ignored | Ignored |
| golang-1.14 | Not in release | Not in release | Not in release | Ignored | — |
| golang-1.16 | Not in release | Not in release | Not in release | Ignored | Ignored |
| golang-1.17 | Not in release | Not in release | Ignored | — | — |
| golang-1.18 | Not in release | Not in release | Ignored | Needs evaluation | Ignored |
| golang-1.20 | Not in release | Not in release | Ignored | Needs evaluation | — |
| golang-1.21 | Not in release | Ignored | Ignored | Needs evaluation | — |
| golang-1.22 | Not in release | Ignored | Ignored | Needs evaluation | — |
| golang-1.23 | Ignored | Ignored | Ignored | — | — |
| golang-1.24 | Ignored | Needs evaluation | Needs evaluation | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Ignored |
| golang-1.9 | Not in release | Not in release | Not in release | — | Ignored |
Some fixes available 3 of 38
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
15 affected packages
golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Fixed | Fixed | Needs evaluation | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
15 affected packages
golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Not affected | Not affected | Needs evaluation | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare...
16 affected packages
golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.10 | Not in release | Not in release | Not in release | — | Vulnerable |
| golang-1.13 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.14 | Not in release | Not in release | Not in release | Vulnerable | — |
| golang-1.16 | Not in release | Not in release | Not in release | Vulnerable | Vulnerable |
| golang-1.17 | Not in release | Not in release | Vulnerable | — | — |
| golang-1.18 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.20 | Not in release | Not in release | Vulnerable | Vulnerable | — |
| golang-1.21 | Not in release | Vulnerable | Vulnerable | Vulnerable | — |
| golang-1.22 | Not in release | Vulnerable | Vulnerable | Vulnerable | — |
| golang-1.23 | Not affected | Vulnerable | Vulnerable | Not in release | — |
| golang-1.24 | Not affected | Not affected | Not affected | Not in release | — |
| golang-1.25 | Not affected | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Vulnerable |
| golang-1.9 | Not in release | Not in release | Not in release | — | Vulnerable |
Some fixes available 3 of 38
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will...
15 affected packages
golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | Not in release | — |
| golang-1.10 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | Not in release | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Fixed | Fixed | Needs evaluation | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | — |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release | — |
| golang-1.8 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
Some fixes available 3 of 38
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do...
15 affected packages
golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang | Not in release | Not in release | Not in release | Not in release | — |
| golang-1.10 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | Not in release | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Fixed | Fixed | Needs evaluation | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | — |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release | — |
| golang-1.8 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |