Gentoo update for Go



Published: 2022-08-05 | Updated: 2022-10-19
Risk High
Patch available YES
Number of vulnerabilities 37
CVE-ID CVE-2022-29526
CVE-2022-23773
CVE-2022-23806
CVE-2022-24675
CVE-2022-24921
CVE-2022-27536
CVE-2022-28131
CVE-2022-28327
CVE-2022-30629
CVE-2022-1705
CVE-2022-30630
CVE-2022-30631
CVE-2022-30632
CVE-2022-30633
CVE-2022-30635
CVE-2022-32148
CVE-2022-32189
CVE-2022-23772
CVE-2021-44717
CVE-2020-28366
CVE-2021-33195
CVE-2020-28367
CVE-2021-27918
CVE-2021-27919
CVE-2021-29923
CVE-2021-3114
CVE-2021-3115
CVE-2021-31525
CVE-2021-33196
CVE-2021-44716
CVE-2021-33197
CVE-2021-33198
CVE-2021-34558
CVE-2021-36221
CVE-2021-38297
CVE-2021-41771
CVE-2021-41772
CWE-ID CWE-264
CWE-863
CWE-252
CWE-120
CWE-185
CWE-295
CWE-400
CWE-190
CWE-330
CWE-444
CWE-254
CWE-20
CWE-94
CWE-79
CWE-835
CWE-682
CWE-78
CWE-674
CWE-862
CWE-399
CWE-362
CWE-119
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #33 is available.
Vulnerable software
Subscribe
Gentoo Linux
Operating systems & Components / Operating system

Vendor Gentoo

Security Bulletin

This security bulletin contains information about 37 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU63173

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-29526

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the Faccessat function can incorrectly report that a file is accessible, when called with a non-zero flags parameter. An attacker can bypass implemented security restrictions.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Incorrect authorization

EUVDB-ID: #VU62037

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-23773

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists within cmd/go, which can misinterpret branch names that falsely appear to be version tags. This can lead to  a situation where an attacker can bypass implemented security restrictions and perform restricted actions, e.g. create tags when access was granted to create branches only.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Unchecked Return Value

EUVDB-ID: #VU62036

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-23806

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to unchecked return value within the Curve.IsOnCurve() function in crypto/elliptic. A remote attacker can force the application to incorrectly return true in situations with a big.Int value that is not a valid field element. As a result, an attacker can modify application flow, which can lead to unauthorized data modification or denial of service.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Buffer overflow

EUVDB-ID: #VU64266

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-24675

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the Golang's library encoding/pem. A remote attacker can send to victim a large (more than 5 MB) PEM input to cause a stack overflow in Decode and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Incorrect Regular Expression

EUVDB-ID: #VU61227

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-24921

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in regexp.Compile in Go. A remote attacker can pass specially crafted input to the application and perform regular expression denial of service (ReDoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Improper Certificate Validation

EUVDB-ID: #VU65267

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-27536

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to certificate.Verify in crypto/x509 in Go can be caused to panic on macOS when presented with certain malformed certificates. A remote unauthenticated attacker can use a TLS server to cause a TLS client to panic.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Resource exhaustion

EUVDB-ID: #VU66069

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-28131

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Decoder.Skip when parsing a deeply nested XML document. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

8) Integer overflow

EUVDB-ID: #VU64269

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-28327

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow in the Golang's library crypto/elliptic. A remote attacker can send a specially crafted scalar input longer than 32 bytes to cause P256().ScalarMult or P256().ScalarBaseMult to panic and perform a denial of service attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

9) Use of insufficiently random values

EUVDB-ID: #VU66122

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-30629

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker gain access to sensitive information.

The vulnerability exists in crypto/tls implementation when generating TLS tickets age. The newSessionTicketMsgTLS13.ageAdd is always set to "0" instead of a random value.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

10) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU66064

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-1705

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of Transfer-Encoding headers in HTTP/1 responses. A remote attacker can send a specially crafted HTTP/1 response to the client and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

11) Resource exhaustion

EUVDB-ID: #VU66063

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-30630

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Glob on a path that contains a large number of path separators. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

12) Resource exhaustion

EUVDB-ID: #VU66062

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-30631

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in Reader.Read method when handling an archive that contains a large number of concatenated 0-length compressed files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

13) Resource exhaustion

EUVDB-ID: #VU66067

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-30632

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Glob on a path that contains a large number of path separators. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

14) Resource exhaustion

EUVDB-ID: #VU66070

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-30633

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

15) Resource exhaustion

EUVDB-ID: #VU66068

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-30635

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Decoder.Decode on a message which contains deeply nested structures. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

16) Security features bypass

EUVDB-ID: #VU66066

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-32148

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to unexpected behavior of httputil.ReverseProxy.ServeHTTP. When the method is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

17) Input validation error

EUVDB-ID: #VU66121

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-32189

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in
Float.GobDecode. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

18) Resource exhaustion

EUVDB-ID: #VU62038

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-23772

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the Rat.SetString(0 function in math/big. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

19) Resource exhaustion

EUVDB-ID: #VU59042

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-44717

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing HTTP/2 requests. A remote attacker can send multiple HTTP/2 requests to the server and exhaust all available memory resources.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

20) Code Injection

EUVDB-ID: #VU48478

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-28366

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation at build time when cgo is in use. A remote attacker can trick the victim into building a specially crafted application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

21) Cross-site scripting

EUVDB-ID: #VU56022

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-33195

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of data passed from DNS lookups. A remote attacker can send a specially crafted DNS reqponse and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

22) Code Injection

EUVDB-ID: #VU48479

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-28367

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation at build time when cgo is in use. A remote attacker can trick the victim to build a specially crafted application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

23) Infinite loop

EUVDB-ID: #VU51486

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-27918

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when using xml.NewTokenDecoder with a custom TokenReader. A remote attacker can trick a victim to open a specially crafted XML content and cause denial of service conditions.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

24) Input validation error

EUVDB-ID: #VU51485

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-27919

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Reader.Open API when use a ZIP archive containing files start with “../”. A remote attacker can trick a victim to open a specially crafted ZIP archive and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

25) Input validation error

EUVDB-ID: #VU56829

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29923

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input in net.ParseIP and net.ParseCIDR, as the Go interpreter does not properly consider extraneous zero characters at the beginning of an IP address octet. A remote attacker can bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

26) Incorrect calculation

EUVDB-ID: #VU50047

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-3114

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect calculation performed by the application in "crypto/elliptic/p224.go". A remote attacker can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

27) OS Command Injection

EUVDB-ID: #VU50046

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-3115

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when using the "go get" command to fetch modules that make use of cgo. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

28) Uncontrolled Recursion

EUVDB-ID: #VU54910

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-31525

CWE-ID: CWE-674 - Uncontrolled Recursion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a DoS attack.

The vulnerability exists due to uncontrolled recursion when processing HTTP headers. A remote attacker can send a large header to ReadRequest or ReadResponse and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

29) Resource exhaustion

EUVDB-ID: #VU54521

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-33196

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing archives. A remote attacker can pass a specially crafted .zip file to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

30) Input validation error

EUVDB-ID: #VU58824

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-44716

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

31) Missing Authorization

EUVDB-ID: #VU56023

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-33197

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to an error in some configurations of ReverseProxy (from net/http/httputil). A remote attacker can drop arbitrary headers and bypass authorization process. 

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

32) Resource management error

EUVDB-ID: #VU56024

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-33198

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling a large exponent to the math/big.Rat SetString or UnmarshalText method.  A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

33) Improper Certificate Validation

EUVDB-ID: #VU55665

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-34558

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper certificate verification in crypto/tls package in Go when processing X.509 certificates. The application does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

34) Race condition

EUVDB-ID: #VU55668

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-36221

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition in net/http/httputil ReverseProxy when handling ErrAbortHandler events. A remote attacker can trigger a race condition and crash the ReverseProxy.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

35) Buffer overflow

EUVDB-ID: #VU57579

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-38297

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

36) Buffer overflow

EUVDB-ID: #VU65080

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-41771

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists in debug/macho of the Go standard library when using the debug/macho standard library (stdlib) and malformed binaries are parsed using Open or OpenFat. A remote attacker can send a specially crafted file to perform a denial of service attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

37) Input validation error

EUVDB-ID: #VU66120

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-41772

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in archive/zip Reader.Open. A remote attacker can pass specially crafted ZIP archive containing an invalid name or an empty filename field to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
dev-lang/go to version: 1.18.5

Vulnerable software versions

Gentoo Linux: All versions


CPE2.3 External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/202208-02

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###