Information on source package golang-1.15

Available versions

ReleaseVersion
bullseye1.15.15-1~deb11u4

Open issues

BugbullseyeDescription
CVE-2024-24785vulnerable (no DSA)If errors returned from MarshalJSON methods contain user controlled da ...
CVE-2024-24784vulnerable (no DSA)The ParseAddressList function incorrectly handles comments (text withi ...
CVE-2024-24783vulnerable (no DSA)Verifying a certificate chain which contains a certificate with an unk ...
CVE-2023-45290vulnerable (no DSA)When parsing a multipart form (either explicitly with Request.ParseMul ...
CVE-2023-45289vulnerable (no DSA)When following an HTTP redirect to a domain which is not a subdomain m ...
CVE-2023-45287vulnerable (no DSA)Before Go 1.20, the RSA based TLS key exchanges used the math/big libr ...
CVE-2023-45285vulnerable (no DSA)Using go get to fetch a module with the ".git" suffix may unexpectedly ...
CVE-2023-39326vulnerable (no DSA)A malicious HTTP sender can use chunk extensions to cause a receiver r ...
CVE-2023-39325vulnerable (no DSA)A malicious HTTP/2 client which rapidly creates requests and immediate ...
CVE-2023-39323vulnerable (no DSA)Line directives ("//line") can be used to bypass the restrictions on " ...
CVE-2023-39319vulnerable (no DSA)The html/template package does not apply the proper rules for handling ...
CVE-2023-39318vulnerable (no DSA)The html/template package does not properly handle HTML-like "" commen ...
CVE-2023-29409vulnerable (no DSA)Extremely large RSA keys in certificate chains can cause a client/serv ...
CVE-2023-29406vulnerable (no DSA)The HTTP/1 client does not fully validate the contents of the Host hea ...
CVE-2023-29405vulnerable (no DSA)The go command may execute arbitrary code at build time when using cgo ...
CVE-2023-29404vulnerable (no DSA)The go command may execute arbitrary code at build time when using cgo ...
CVE-2023-29403vulnerable (no DSA)On Unix platforms, the Go runtime does not behave differently when a b ...
CVE-2023-29402vulnerable (no DSA)The go command may generate unexpected code at build time when using c ...
CVE-2023-29400vulnerable (no DSA)Templates containing actions in unquoted HTML attributes (e.g. "attr={ ...
CVE-2023-24540vulnerable (no DSA)Not all valid JavaScript whitespace characters are considered to be wh ...
CVE-2023-24539vulnerable (no DSA)Angle brackets (<>) are not considered dangerous characters when inser ...
CVE-2023-24538vulnerable (no DSA)Templates do not properly consider backticks (`) as Javascript string ...
CVE-2023-24537vulnerable (no DSA)Calling any of the Parse functions on Go source code which contains // ...
CVE-2023-24536vulnerable (no DSA)Multipart form parsing can consume large amounts of CPU and memory whe ...
CVE-2023-24534vulnerable (no DSA)HTTP and MIME header parsing can allocate large amounts of memory, eve ...
CVE-2023-24532vulnerable (no DSA)The ScalarMult and ScalarBaseMult methods of the P256 Curve may return ...
CVE-2022-41725vulnerable (no DSA)A denial of service is possible from excessive resource consumption in ...
CVE-2022-41724vulnerable (no DSA)Large handshake records may cause panics in crypto/tls. Both clients a ...
CVE-2022-41723vulnerable (no DSA)A maliciously crafted HTTP/2 stream could cause excessive CPU consumpt ...
CVE-2022-41717vulnerable (no DSA)An attacker can cause excessive memory growth in a Go server accepting ...
CVE-2022-41715vulnerable (no DSA)Programs which compile regular expressions from untrusted sources may ...
CVE-2022-32189vulnerable (no DSA)A too-short encoded message can cause a panic in Float.GobDecode and R ...
CVE-2022-32148vulnerable (no DSA)Improper exposure of client IP addresses in net/http before Go 1.17.12 ...
CVE-2022-30635vulnerable (no DSA)Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.1 ...
CVE-2022-30633vulnerable (no DSA)Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 ...
CVE-2022-30632vulnerable (no DSA)Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and ...
CVE-2022-30631vulnerable (no DSA)Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17. ...
CVE-2022-30629vulnerable (no DSA)Non-random values for ticket_age_add in session tickets in crypto/tls ...
CVE-2022-29526vulnerable (no DSA)Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Ass ...
CVE-2022-28131vulnerable (no DSA)Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17. ...
CVE-2022-27664vulnerable (no DSA)In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers ca ...
CVE-2022-2880vulnerable (no DSA)Requests forwarded by ReverseProxy include the raw query parameters fr ...
CVE-2022-2879vulnerable (no DSA)Reader.Read does not set a limit on the maximum size of file headers. ...
CVE-2022-1962vulnerable (no DSA)Uncontrolled recursion in the Parse functions in go/parser before Go 1 ...
CVE-2022-1705vulnerable (no DSA)Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 cli ...
CVE-2021-29923vulnerable (no DSA)Go before 1.17 does not properly consider extraneous zero characters a ...

Open unimportant issues

BugbullseyeDescription
CVE-2023-45284vulnerableOn Windows, The IsLocal function does not correctly detect reserved de ...
CVE-2023-45283vulnerableThe filepath package does not recognize paths with a \??\ prefix as sp ...
CVE-2022-41722vulnerableA path traversal vulnerability exists in filepath.Clean on Windows. On ...
CVE-2022-41720vulnerableOn Windows, restricted files can be accessed via os.DirFS and http.Dir ...
CVE-2022-41716vulnerableDue to unsanitized NUL values, attackers may be able to maliciously se ...
CVE-2020-29511vulnerableThe encoding/xml package in Go (all versions) does not correctly prese ...
CVE-2020-29510vulnerableThe encoding/xml package in Go versions 1.15 and earlier does not corr ...
CVE-2020-29509vulnerableThe encoding/xml package in Go (all versions) does not correctly prese ...

Resolved issues

BugDescription
CVE-2022-32190JoinPath and URL.JoinPath do not remove ../ path elements appended to ...
CVE-2022-30634Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 o ...
CVE-2022-30630Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18. ...
CVE-2022-30580Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 ...
CVE-2022-29804Incorrect conversion of certain invalid paths to valid, absolute paths ...
CVE-2022-24921regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows st ...
CVE-2022-23806Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x bef ...
CVE-2022-23773cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret ...
CVE-2022-23772Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17. ...
CVE-2021-44717Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operat ...
CVE-2021-44716net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontro ...
CVE-2021-41772Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reade ...
CVE-2021-41771ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16 ...
CVE-2021-39293In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted ...
CVE-2021-38297Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via la ...
CVE-2021-36221Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that c ...
CVE-2021-34558The crypto/tls package of Go through 1.16.5 does not properly assert t ...
CVE-2021-33198In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic fo ...
CVE-2021-33197In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ...
CVE-2021-33196In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafte ...
CVE-2021-33195Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS looku ...
CVE-2021-31525net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote a ...
CVE-2021-27919archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a den ...
CVE-2021-27918encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infin ...
CVE-2021-3115Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to ...
CVE-2021-3114In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go ...
CVE-2020-28367Code injection in the go command with cgo before Go 1.14.12 and Go 1.1 ...
CVE-2020-28366Code injection in the go command with cgo before Go 1.14.12 and Go 1.1 ...
CVE-2020-28362Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
CVE-2020-24553Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html ...
CVE-2020-16845Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loo ...
CVE-2020-15586Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net ...
CVE-2020-14039In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may ...

Search for package or bug name: Reporting problems