Search CVE reports
41 – 47 of 47 results
Some fixes available 26 of 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
17 affected packages
golang-1.13, golang-1.14, golang-1.16, golang-1.17, golang-1.18...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.13 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.14 | — | — | Not in release | Vulnerable | Not in release |
| golang-1.16 | — | — | Not in release | Fixed | Fixed |
| golang-1.17 | — | — | Vulnerable | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.8 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.9 | — | — | Not in release | Not in release | Vulnerable |
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| google-guest-agent | Fixed | Fixed | Fixed | Fixed | Needs evaluation |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| golang | — | — | Not in release | Not in release | Not in release |
| golang-1.10 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.6 | — | — | Not in release | Not in release | Not in release |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. NOTE: this finding could not be reproduced by...
2 affected packages
golang-github-kardianos-service, google-guest-agent
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-kardianos-service | — | — | Not affected | Not affected | Not in release |
| google-guest-agent | — | — | Not affected | Not affected | Not affected |
Some fixes available 8 of 24
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
8 affected packages
google-guest-agent, golang-1.17, golang-1.15, golang-1.11, golang-1.8...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| google-guest-agent | Fixed | Fixed | Fixed | Fixed | Vulnerable |
| golang-1.17 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| golang-1.15 | — | — | — | Not in release | Not in release |
| golang-1.11 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.7 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Vulnerable | Vulnerable |
| golang-golang-x-net | Not affected | Not affected | Not affected | Not in release | Not in release |
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some...
6 affected packages
google-guest-agent, golang-1.16, golang-1.15, golang-1.11, golang-golang-x-net, golang-golang-x-net-dev
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| google-guest-agent | Not affected | Not affected | Not affected | Not affected | Not affected |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.15 | — | — | — | Not in release | Not in release |
| golang-1.11 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-golang-x-net | Not affected | Not affected | Not affected | Not in release | Not in release |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
Some fixes available 2 of 10
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
4 affected packages
golang-golang-x-net, golang-golang-x-net-dev, google-guest-agent, lxd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | — | Not affected | Not affected | Not in release | Not in release |
| golang-golang-x-net-dev | — | Not in release | Not in release | Fixed | Not affected |
| google-guest-agent | — | Not affected | Not affected | Not affected | Not affected |
| lxd | — | Not in release | Not in release | Not affected | Fixed |
Some fixes available 3 of 9
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
3 affected packages
google-guest-agent, golang-golang-x-text, golang-x-text
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| google-guest-agent | Not affected | Not affected | Not affected | Not affected | Not affected |
| golang-golang-x-text | Not affected | Not affected | Not affected | Fixed | Not in release |
| golang-x-text | Not in release | Not in release | Not in release | Vulnerable | Fixed |
Some fixes available 3 of 10
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
3 affected packages
google-guest-agent, golang-golang-x-text, golang-x-text
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| google-guest-agent | Not affected | Not affected | Not affected | Not affected | Not affected |
| golang-golang-x-text | Not affected | Not affected | Not affected | Fixed | Not in release |
| golang-x-text | Not in release | Not in release | Not in release | Vulnerable | Fixed |