Information on source package golang

Available versions

ReleaseVersion
jessie2:1.3.3-1+deb8u5

Open issues

BugjessieDescription
TEMP-0000000-1C4729vulnerable (no DSA)net/http: broken trailers don't close a server connection
CVE-2022-41715vulnerable (no DSA, postponed)Programs which compile regular expressions from untrusted sources may ...
CVE-2022-32189vulnerable (no DSA, postponed)A too-short encoded message can cause a panic in Float.GobDecode and R ...
CVE-2022-32148vulnerable (no DSA, postponed)Improper exposure of client IP addresses in net/http before Go 1.17.12 ...
CVE-2022-30635vulnerable (no DSA, postponed)Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.1 ...
CVE-2022-30633vulnerable (no DSA, postponed)Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 ...
CVE-2022-30632vulnerable (no DSA, postponed)Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and ...
CVE-2022-30631vulnerable (no DSA, postponed)Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17. ...
CVE-2022-28131vulnerable (no DSA, postponed)Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17. ...
CVE-2022-24921vulnerable (no DSA, ignored)regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows st ...
CVE-2022-23772vulnerable (no DSA, ignored)Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17. ...
CVE-2022-2880vulnerable (no DSA, postponed)Requests forwarded by ReverseProxy include the raw query parameters fr ...
CVE-2022-2879vulnerable (no DSA, postponed)Reader.Read does not set a limit on the maximum size of file headers. ...
CVE-2022-1962vulnerable (no DSA, postponed)Uncontrolled recursion in the Parse functions in go/parser before Go 1 ...
CVE-2021-34558vulnerable (no DSA, postponed)The crypto/tls package of Go through 1.16.5 does not properly assert t ...
CVE-2021-33197vulnerable (no DSA, postponed)In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ...
CVE-2021-33195vulnerable (no DSA, postponed)Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS looku ...
CVE-2021-29923vulnerable (no DSA, ignored)Go before 1.17 does not properly consider extraneous zero characters a ...
CVE-2021-27918vulnerable (no DSA, postponed)encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infin ...
CVE-2021-3115vulnerable (no DSA, ignored)Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to ...
CVE-2020-28367vulnerable (no DSA, ignored)Code injection in the go command with cgo before Go 1.14.12 and Go 1.1 ...
CVE-2020-28366vulnerable (no DSA, ignored)Code injection in the go command with cgo before Go 1.14.12 and Go 1.1 ...
CVE-2020-24553vulnerable (no DSA, postponed)Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html ...
CVE-2020-15586vulnerable (no DSA, ignored)Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net ...
CVE-2019-14809vulnerable (no DSA, ignored)net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malfo ...
CVE-2018-16875vulnerable (no DSA, ignored)The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 d ...
CVE-2018-6574vulnerable (no DSA, ignored)Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases befor ...
CVE-2017-15042vulnerable (no DSA, ignored)An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x befo ...
CVE-2015-5741vulnerable (no DSA)The net/http library in net/http/transfer.go in Go before 1.4.3 does n ...
CVE-2015-5740vulnerable (no DSA)The net/http library in net/http/transfer.go in Go before 1.4.3 does n ...

Open unimportant issues

BugjessieDescription
CVE-2020-29511vulnerableThe encoding/xml package in Go (all versions) does not correctly prese ...
CVE-2020-29510vulnerableThe encoding/xml package in Go versions 1.15 and earlier does not corr ...
CVE-2020-29509vulnerableThe encoding/xml package in Go (all versions) does not correctly prese ...
CVE-2016-5386vulnerableThe net/http package in Go through 1.6 does not attempt to address RFC ...

Resolved issues

BugDescription
CVE-2022-41716Due to unsanitized NUL values, attackers may be able to maliciously se ...
CVE-2022-32190JoinPath and URL.JoinPath do not remove ../ path elements appended to ...
CVE-2022-30634Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 o ...
CVE-2022-30630Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18. ...
CVE-2022-30629Non-random values for ticket_age_add in session tickets in crypto/tls ...
CVE-2022-30580Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 ...
CVE-2022-29804Incorrect conversion of certain invalid paths to valid, absolute paths ...
CVE-2022-29526Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Ass ...
CVE-2022-27664In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers ca ...
CVE-2022-23806Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x bef ...
CVE-2022-23773cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret ...
CVE-2022-1705Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 cli ...
CVE-2021-44717Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operat ...
CVE-2021-44716net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontro ...
CVE-2021-41772Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reade ...
CVE-2021-41771ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16 ...
CVE-2021-39293In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted ...
CVE-2021-38297Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via la ...
CVE-2021-36221Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that c ...
CVE-2021-33198In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic fo ...
CVE-2021-33196In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafte ...
CVE-2021-31525net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote a ...
CVE-2021-3114In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go ...
CVE-2020-28362Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
CVE-2020-16845Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loo ...
CVE-2020-14039In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may ...
CVE-2020-7919Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte ...
CVE-2019-17596Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to ...
CVE-2019-16276Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smugglin ...
CVE-2019-11888Go through 1.12.5 on Windows mishandles process creation with a nil en ...
CVE-2019-9741An issue was discovered in net/http in Go 1.11.5. CRLF injection is po ...
CVE-2019-9634Go through 1.12 on Windows misuses certain LoadLibrary functionality, ...
CVE-2019-9514Some HTTP/2 implementations are vulnerable to a reset flood, potential ...
CVE-2019-9512Some HTTP/2 implementations are vulnerable to ping floods, potentially ...
CVE-2019-6486Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 e ...
CVE-2018-16874In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is ...
CVE-2018-16873In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is ...
CVE-2018-7187The "go get" implementation in Go 1.9.4, when the -insecure command-li ...
CVE-2017-1000098The net/http package's Request.ParseMultipartForm method starts writin ...
CVE-2017-1000097On Darwin, user's trust preferences for root certificates were not hon ...
CVE-2017-15041Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command ...
CVE-2017-8932A bug in the standard library ScalarMult implementation of curve P-256 ...
CVE-2016-3959The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x ...
CVE-2016-3958Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x befor ...
CVE-2015-8618The Int.Exp Montgomery code in the math/big library in Go 1.5.x before ...
CVE-2015-5739The net/http library in net/textproto/reader.go in Go before 1.4.3 doe ...
CVE-2014-7189crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enab ...

Security announcements

DSA / DLADescription
ELA-600-1golang - security update
ELA-547-1golang - security update
ELA-379-1golang - security update
DLA-1749-1golang - security update
DLA-1664-1golang - security update
DLA-1294-1golang - security update
DLA-1148-1golang - security update
DLA-1123-1golang - security update

Search for package or bug name: Reporting problems