{"id":"CVE-2022-29526","aliases":["ALPINE-CVE-2022-29526","AZL-31975","AZL-33622","AZL-33629","AZL-33644","AZL-35007","AZL-35014","AZL-35039","AZL-35115","AZL-35283","AZL-37365","AZL-37490","AZL-38911","AZL-39668","AZL-43477","AZL-43729","AZL-43858","AZL-43900","AZL-43915","AZL-44238","AZL-44289","AZL-44313","AZL-45294","AZL-45402","AZL-47178","BELL-CVE-2022-29526","BIT-golang-2022-29526","DEBIAN-CVE-2022-29526","EUVD-2022-6106","GHSA-p782-xgp4-8hr8","GO-2022-0493","MGASA-2022-0210","OESA-2022-1857","RHSA-2022:5337","RHSA-2022:5729","RHSA-2022:5799","RHSA-2022:6277","RLSA-2022:5337","RLSA-2022:5799","SUSE-SU-2022:1829-1","SUSE-SU-2022:1862-1","SUSE-SU-2023:2312-1","UBUNTU-CVE-2022-29526","USN-6038-1","USN-6038-2","openSUSE-SU-2024:12065-1","openSUSE-SU-2024:12066-1"],"status":"published","title":"golang.org/x/sys/unix has Incorrect privilege reporting in syscall","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02951,"percentile":0.87285,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2022-05-24T08:58:14Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"golang.org/x/sys","fixed_in":["0.0.0-20220412211240-33da011f77ad"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.15","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"docker","fixed_in":["20.10.16-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kured","fixed_in":["1.13.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nmi","fixed_in":["1.8.11-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"prometheus","fixed_in":["2.37.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"sriov-network-device-plugin","fixed_in":["3.6.2-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-engine","fixed_in":["25.0.3-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"multus","fixed_in":["4.0.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"node-problem-detector","fixed_in":["0.8.15-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"prometheus","fixed_in":["2.37.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"sriov-network-device-plugin","fixed_in":["3.7.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.21.6-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cni","fixed_in":["1.1.2-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cri-o","fixed_in":["1.21.7-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"buildah","fixed_in":["1.41.4-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"podman","fixed_in":["5.6.1-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containernetworking-plugins","fixed_in":["1.6.1-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"golang","fixed_in":["1.22.7-2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.17.10","1.18.2"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.17.10","1.18.2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"golang","fixed_in":["1.17.10-1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.18","fixed_in":["1.18.2-150000.1.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.18","fixed_in":["1.18.2-150000.1.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"go1.18","fixed_in":["1.18.2-150000.1.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"go1.18","fixed_in":["1.18.2-150000.1.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.17","fixed_in":["1.17.10-150000.1.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.17","fixed_in":["1.17.10-150000.1.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"go1.17","fixed_in":["1.17.10-150000.1.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"go1.17","fixed_in":["1.17.10-150000.1.34.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1~18.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","fixed_in":["1.16.2-0ubuntu1~18.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.16","fixed_in":["1.16.2-0ubuntu1~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1~20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"go1.17","fixed_in":["1.17.10-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"go1.18","fixed_in":["1.18.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"golang.org/x/sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20220412211240-33da011f77ad"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.16-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.11-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"sriov-network-device-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"multus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"node-problem-detector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"sriov-network-device-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.7-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"umoci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.7-18"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.1-26"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.5.0-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.18.0-29"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.4-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"umoci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.7-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.5.0-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.7-2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.17.10"},{"introduced":"1.18.0"},{"fixed":"1.18.2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"golang-1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.15-1","1.15.15-1~deb11u1","1.15.15-1~deb11u2","1.15.15-1~deb11u3","1.15.15-1~deb11u4","1.15.15-2","1.15.15-3","1.15.15-4","1.15.15-5","1.15.9-6"]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20220412211240-33da011f77ad"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.17.10"},{"introduced":"1.18.0-0"},{"fixed":"1.18.2"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20220412211240-33da011f77ad"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.10-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-16.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-16.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-7.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+15486+6d4da7db"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+15486+6d4da7db"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+15486+6d4da7db"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+15486+6d4da7db"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+15486+6d4da7db"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+15486+6d4da7db"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+15486+6d4da7db"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+15486+6d4da7db"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-1.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-1.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-1.1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-1.1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-1.1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g012e945.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g012e945.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"atomic-openshift-service-idler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g012e945.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202207192015.p0.g012e945.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-pilot-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-pilot-discovery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.0-9.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-ratelimit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-proxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:2.1::el8","package":"servicemesh-proxy-wasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+824+8e984c20"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+986+efe4cea4"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.10-1.module+el8.6.0+986+efe4cea4"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"Rocky Linux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.12-1.el9_0"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-150000.1.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-150000.1.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-150000.1.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-150000.1.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.10-150000.1.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.10-150000.1.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.10-150000.1.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.10-150000.1.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~18.04.4"}]}],"versions":["1.18.1-1ubuntu1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-0ubuntu1~18.04.2+esm1"}]}],"versions":["1.16.2-0ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-0ubuntu1~20.04.1"}]}],"versions":["1.16.2-0ubuntu1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~20.04.2"}]}],"versions":["1.18.1-1ubuntu1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1.1"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~18.04.4"}]}],"versions":["1.18.1-1ubuntu1~18.04.3"],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~20.04.2"}]}],"versions":["1.18.1-1ubuntu1~20.04.1"],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1.1"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1"],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.8-1ubuntu1~16.04.3+esm3"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.8-1ubuntu1~18.04.4+esm1"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-0ubuntu1~18.04.2+esm1"}]}],"versions":["1.16.2-0ubuntu1~18.04.2"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.8-1ubuntu1.2"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-0ubuntu1~20.04.1"}]}],"versions":["1.16.2-0ubuntu1~20.04"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.8-1ubuntu2.22.04.2"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1"],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.10-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"golang","product":"go"},{"vendor":"netapp","product":"beegfs_csi_driver"}],"references":[{"url":"https://groups.google.com/g/golang-announce","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://github.com/golang/go/issues/52313","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","advisory","report","web"]},{"url":"https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220729-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29526","tags":["web","advisory"]},{"url":"https://go.dev/cl/399539","tags":["web","fix"]},{"url":"https://go.dev/cl/400074","tags":["web","fix"]},{"url":"https://go.dev/issue/52313","tags":["web","report"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0493","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220729-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p782-xgp4-8hr8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-29526","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-29526","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29526.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-29526","tags":["advisory"]},{"url":"https://github.com/golang/go","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0210.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30469","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H2A43RISVL27M3ODDCLLDJKV265ATZ43/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29804","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5337","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084085","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5337.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24675","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/oecdBNLOml8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24921","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28327","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28327","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29526","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5729","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5729.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23773","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053429","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23806","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5799","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107392","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5799.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1705","tags":["advisory"]},{"url":"https://go.dev/issue/53188","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1962","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://go.dev/issue/53616","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28131","tags":["advisory"]},{"url":"https://go.dev/issue/53614","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092793","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30629","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30629","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30630","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30630","tags":["advisory"]},{"url":"https://go.dev/issue/53415","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30631","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30631","tags":["advisory"]},{"url":"https://go.dev/issue/53168","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30632","tags":["advisory"]},{"url":"https://go.dev/issue/53416","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30633","tags":["advisory"]},{"url":"https://go.dev/issue/53611","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30635","tags":["advisory"]},{"url":"https://go.dev/issue/53615","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32148","tags":["advisory"]},{"url":"https://go.dev/issue/53423","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6277","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105075","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6277.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24785","tags":["advisory"]},{"url":"https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31129","tags":["advisory"]},{"url":"https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5337","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5799","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221829-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193742","tags":["report"]},{"url":"https://bugzilla.suse.com/1199413","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29526","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221862-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190649","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232312-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183043","tags":["report"]},{"url":"https://bugzilla.suse.com/1198423","tags":["report"]},{"url":"https://bugzilla.suse.com/1198424","tags":["report"]},{"url":"https://bugzilla.suse.com/1198427","tags":["report"]},{"url":"https://bugzilla.suse.com/1200134","tags":["report"]},{"url":"https://bugzilla.suse.com/1200135","tags":["report"]},{"url":"https://bugzilla.suse.com/1200136","tags":["report"]},{"url":"https://bugzilla.suse.com/1200137","tags":["report"]},{"url":"https://bugzilla.suse.com/1201434","tags":["report"]},{"url":"https://bugzilla.suse.com/1201436","tags":["report"]},{"url":"https://bugzilla.suse.com/1201437","tags":["report"]},{"url":"https://bugzilla.suse.com/1201440","tags":["report"]},{"url":"https://bugzilla.suse.com/1201443","tags":["report"]},{"url":"https://bugzilla.suse.com/1201444","tags":["report"]},{"url":"https://bugzilla.suse.com/1201445","tags":["report"]},{"url":"https://bugzilla.suse.com/1201447","tags":["report"]},{"url":"https://bugzilla.suse.com/1201448","tags":["report"]},{"url":"https://bugzilla.suse.com/1202035","tags":["report"]},{"url":"https://bugzilla.suse.com/1203185","tags":["report"]},{"url":"https://bugzilla.suse.com/1204023","tags":["report"]},{"url":"https://bugzilla.suse.com/1204024","tags":["report"]},{"url":"https://bugzilla.suse.com/1204025","tags":["report"]},{"url":"https://bugzilla.suse.com/1204941","tags":["report"]},{"url":"https://bugzilla.suse.com/1206134","tags":["report"]},{"url":"https://bugzilla.suse.com/1206135","tags":["report"]},{"url":"https://bugzilla.suse.com/1208270","tags":["report"]},{"url":"https://bugzilla.suse.com/1208271","tags":["report"]},{"url":"https://bugzilla.suse.com/1208272","tags":["report"]},{"url":"https://bugzilla.suse.com/1208491","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41725","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-29526","tags":["report"]},{"url":"https://github.com/golang/go/commit/f66925e854e71e0c54b581885380a490d7afa30c","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6038-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6038-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41717","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24538","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-22T13:15:32Z","modified":"2024-08-03T06:26:06.342Z","updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-6106","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-22T13:15:32Z","modified":"2024-08-03T06:26:06Z","updated_at":"2026-11-03T03:25:38.110935Z"}],"ghsa":[{"id":"GHSA-p782-xgp4-8hr8","title":"golang.org/x/sys/unix has Incorrect privilege reporting in syscall","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Reporting in syscall. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.\n\n### Specific Go Packages Affected\ngolang.org/x/sys/unix","status":"published","published":"2022-06-24T00:00:30Z","modified":"2024-05-20T21:27:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12.747Z","modified":"2026-06-17T04:40:22.153Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"ALPINE-CVE-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12.747Z","modified":"2026-11-03T07:31:15.539433589Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"AZL-31975","title":"CVE-2022-29526 affecting package kured for versions less than 1.13.2-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:26:36.261767Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-33622","title":"CVE-2022-29526 affecting package nmi for versions less than 1.8.11-2","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:26:55.853127Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-33629","title":"CVE-2022-29526 affecting package prometheus for versions less than 2.37.0-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:26:56.682202Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-33644","title":"CVE-2022-29526 affecting package sriov-network-device-plugin for versions less than 3.6.2-2","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:26:57.656702Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-35007","title":"CVE-2022-29526 affecting package moby-engine for versions less than 25.0.3-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:49:23.67752Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-35014","title":"CVE-2022-29526 affecting package multus for versions less than 4.0.2-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:51:17.952357Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-35039","title":"CVE-2022-29526 affecting package node-problem-detector for versions less than 0.8.15-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:49:29.463774Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35115","title":"CVE-2022-29526 affecting package prometheus for versions less than 2.37.0-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:50:47.756894Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35283","title":"CVE-2022-29526 affecting package sriov-network-device-plugin for versions less than 3.7.0-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:50:59.769052Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-37365","title":"CVE-2022-29526 affecting package golang for versions less than 1.21.6-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:28:17.045261Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37490","title":"CVE-2022-29526 affecting package golang for versions less than 1.21.6-1","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:28:21.926696Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-38911","title":"CVE-2022-29526 affecting package cni for versions less than 1.1.2-4","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:19.751978Z"},{"id":"AZL-39668","title":"CVE-2022-29526 affecting package cri-o for versions less than 1.21.7-2","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:28:47.730853Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-43477","title":"CVE-2022-29526 affecting package containernetworking-plugins 1.1.1-17","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:31:02.048334Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-43729","title":"CVE-2022-29526 affecting package umoci 0.4.7-18","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:31:07.782651Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-43858","title":"CVE-2022-29526 affecting package podman 4.1.1-26","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:31:11.151355Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-43900","title":"CVE-2022-29526 affecting package delve 1.5.0-20","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:31:12.720161Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-43915","title":"CVE-2022-29526 affecting package buildah 1.18.0-29","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:31:12.911687Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44238","title":"CVE-2022-29526 affecting package buildah for versions less than 1.41.4-2","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:49:24.868163Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44289","title":"CVE-2022-29526 affecting package umoci 0.4.7-13","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"AZL-44313","title":"CVE-2022-29526 affecting package podman for versions less than 5.6.1-2","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:54:16.369692Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-45294","title":"CVE-2022-29526 affecting package containernetworking-plugins for versions less than 1.6.1-4","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:49:53.819019Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-45402","title":"CVE-2022-29526 affecting package delve 1.5.0-16","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"AZL-47178","title":"CVE-2022-29526 affecting package golang for versions less than 1.22.7-2","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12Z","modified":"2026-04-21T04:51:17.541029Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"BELL-CVE-2022-29526","title":"CVE-2022-29526 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:42.514846Z","modified":"2026-01-26T09:48:53.212078Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"DEBIAN-CVE-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:12.747Z","modified":"2026-08-27T23:04:21.162187735Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:36.969609Z"},{"id":"GHSA-p782-xgp4-8hr8","title":"golang.org/x/sys/unix has Incorrect privilege reporting in syscall","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Reporting in syscall. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.\n\n### Specific Go Packages Affected\ngolang.org/x/sys/unix","status":"published","published":"2022-06-24T00:00:30Z","modified":"2026-09-10T03:49:55.20325821Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"OESA-2022-1857","title":"golang security update","description":"The Go Programming Language.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nGo before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.(CVE-2022-29526)\r\n\r\nIncorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.(CVE-2022-29804)","status":"published","published":"2022-08-26T11:05:07Z","modified":"2026-08-18T01:17:10.200967765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:5337","title":"Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update","status":"published","published":"2024-10-21T18:06:18Z","modified":"2026-10-14T10:02:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5729","title":"Red Hat Security Advisory: OpenShift Container Platform 4.10.25 security update","status":"published","published":"2024-09-30T14:22:28Z","modified":"2026-10-16T10:01:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5799","title":"Red Hat Security Advisory: go-toolset and golang security and bug fix update","status":"published","published":"2024-09-30T14:22:37Z","modified":"2026-10-20T10:01:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6277","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.5 security update","status":"published","published":"2024-09-30T14:24:07Z","modified":"2026-10-15T10:03:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:5337","title":"Moderate: go-toolset:rhel8 security and bug fix update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)\n\n* golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)\n\n* golang: syscall: faccessat checks wrong group (CVE-2022-29526)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Update to Go 1.17.10 (BZ#2091077)","status":"published","published":"2022-06-28T10:54:21Z","modified":"2026-02-04T11:45:10.974048Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:5799","title":"Important: go-toolset and golang security and bug fix update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)\n\n* golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)\n\n* golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)\n\n* golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)\n\n* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)\n\n* golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)\n\n* golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)\n\n* golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)\n\n* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Clean up dist-git patches (BZ#2109174)\n\n* Update Go to version 1.17.12 (BZ#2109183)","status":"published","published":"2022-08-01T15:29:25Z","modified":"2026-02-04T07:40:21.568848Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-23T17:15:00Z","modified":"2026-02-04T04:30:44.287986Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"BIT-golang-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2024-03-06T11:00:56.694Z","modified":"2026-09-08T08:47:48.870231844Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"CVE-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.","status":"published","published":"2022-06-22T13:15:32Z","modified":"2026-10-28T02:30:32.695912288Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"GO-2022-0493","title":"Incorrect privilege reporting in syscall and golang.org/x/sys/unix","description":"When called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible.","status":"published","published":"2022-07-15T23:30:12Z","modified":"2026-02-04T03:42:54.589715Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"MGASA-2022-0210","title":"Updated golang packages fix security vulnerability","description":"The syscall.Faccessat function checks whether the calling process can\naccess a file. Faccessat contains a bug where it checks a file’s group\npermission bits if the process’s user is a member of the process’s group\nrather than a member of the file’s group. (CVE-2022-29526)\n","status":"published","published":"2022-05-28T08:56:13Z","modified":"2026-04-16T04:40:37.019828076Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12065-1","title":"go1.17-1.17.10-1.1 on GA media","description":"These are all security issues fixed in the go1.17-1.17.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:23.96821Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12066-1","title":"go1.18-1.18.2-1.1 on GA media","description":"These are all security issues fixed in the go1.18-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:14:02.15851Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1829-1","title":"Security update for go1.18","description":"This update for go1.18 fixes the following issues:\n\n- CVE-2022-29526: Fixed faccessat() system call operation that checked the wrong group (bsc#1199413).\n\n- go1.18.2 (released 2022-05-10) (bsc#1193742).\n","status":"published","published":"2022-05-24T08:58:14Z","modified":"2026-02-04T04:19:03.14857Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1862-1","title":"Security update for go1.17","description":"This update for go1.17 fixes the following issues:\n\n- CVE-2022-29526: Fixed faccessat() system call operation that checked the wrong group (bsc#1199413).\n\n- go1.17.10 (released 2022-05-10) (bsc#1190649).\n","status":"published","published":"2022-05-26T10:41:55Z","modified":"2026-02-04T03:58:38.291534Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2023:2312-1","title":"Security update for go1.18-openssl","description":"This update for go1.18-openssl fixes the following issues:\n\n- Add subpackage go1.x-libstd compiled shared object libstd.so (jsc#PED-1962)\n  * Main go1.x package included libstd.so in previous versions\n  * Split libstd.so into subpackage that can be installed standalone\n  * Continues the slimming down of main go1.x package by 40 Mb\n  * Experimental and not recommended for general use, Go currently has no ABI\n  * Upstream Go has not committed to support buildmode=shared long-term\n  * Do not use in packaging, build static single binaries (the default)\n  * Upstream Go go1.x binary releases do not include libstd.so\n  * go1.x Suggests go1.x-libstd so not installed by default Recommends\n  * go1.x-libstd does not Require: go1.x so can install standalone\n  * Provides go-libstd unversioned package name\n  * Fix build step -buildmode=shared std to omit -linkshared\n- Packaging improvements:\n  * go1.x Suggests go1.x-doc so not installed by default Recommends\n  * Use Group: Development/Languages/Go instead of Other\n\n- Improvements to go1.x packaging spec:\n  * On Tumbleweed bootstrap with current default gcc13 and gccgo118\n  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap\n    using go1.x package (%bcond_without gccgo). This is no longer\n    needed on current SLE-12:Update and removing will consolidate\n    the build configurations used.\n  * Change source URLs to go.dev as per Go upstream\n  * On x86_64 export GOAMD64=v1 as per the current baseline.\n    At this time forgo GOAMD64=v3 option for x86_64_v3 support.\n  * On x86_64 %define go_amd64=v1 as current instruction baseline\n\n- Update to version 1.18.10.1 cut from the go1.18-openssl-fips\n  branch at the revision tagged go1.18.10-1-openssl-fips.\n  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips\n  * Merge go1.18.10 into dev.boringcrypto.go1.18\n\n- go1.18.10 (released 2023-01-10) includes fixes to cgo, the\n  compiler, the linker, and the crypto/x509, net/http, and syscall\n  packages.\n  Refs bsc#1193742 go1.18 release tracking\n  * go#57705 misc/cgo: backport needed for dlltool fix\n  * go#57426 crypto/x509: Verify on macOS does not return typed errors\n  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its 'old' argument.\n  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices\n  * go#57213 os: TestLstat failure on Linux Aarch64\n  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length\n  * go#57057 cmd/go: remove test dependency on gopkg.in service\n  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders\n  * go#57044 cgo: malformed DWARF TagVariable entry\n  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14\n  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused\n  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target\n  * go#56323 net/http: bad handling of HEAD requests with a body\n","status":"published","published":"2023-05-30T06:54:51Z","modified":"2026-02-04T03:20:56.665396Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-6038-1","title":"golang-1.18 vulnerabilities","description":"It was discovered that the Go net/http module incorrectly handled\nTransfer-Encoding headers in the HTTP/1 client. A remote attacker could\npossibly use this issue to perform an HTTP Request Smuggling attack.\n(CVE-2022-1705)\n\nIt was discovered that Go did not properly manage memory under certain\ncircumstances. An attacker could possibly use this issue to cause a panic\nresulting into a denial of service. (CVE-2022-1962, CVE-2022-27664,\nCVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632,\nCVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715,\nCVE-2022-41717, CVE-2023-24534, CVE-2023-24537)\n\nIt was discovered that Go did not properly implemented the maximum size of\nfile headers in Reader.Read. An attacker could possibly use this issue to\ncause a panic resulting into a denial of service. (CVE-2022-2879)\n\nIt was discovered that the Go net/http module incorrectly handled query\nparameters in requests forwarded by ReverseProxy. A remote attacker could\npossibly use this issue to perform an HTTP Query Parameter Smuggling attack.\n(CVE-2022-2880)\n\nIt was discovered that Go did not properly manage the permissions for\nFaccessat function. A attacker could possibly use this issue to expose\nsensitive information. (CVE-2022-29526)\n\nIt was discovered that Go did not properly generate the values for\nticket_age_add in session tickets. An attacker could possibly use this\nissue to observe TLS handshakes to correlate successive connections by\ncomparing ticket ages during session resumption. (CVE-2022-30629)\n\nIt was discovered that Go did not properly manage client IP addresses in\nnet/http. An attacker could possibly use this issue to cause ReverseProxy\nto set the client IP as the value of the X-Forwarded-For header.\n(CVE-2022-32148)\n\nIt was discovered that Go did not properly validate backticks (`) as\nJavascript string delimiters, and do not escape them as expected. An\nattacker could possibly use this issue to inject arbitrary Javascript code\ninto the Go template. (CVE-2023-24538)\n","status":"published","published":"2023-04-25T10:23:57Z","modified":"2026-04-27T16:47:20.971153217Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-6038-2","title":"golang-1.13, golang-1.16 vulnerabilities","description":"USN-6038-1 fixed several vulnerabilities in Go 1.18. This update provides\nthe corresponding updates for Go 1.13 and Go 1.16.\n\nCVE-2022-29526 and CVE-2022-30630 only affected Go 1.16.\n\nOriginal advisory details:\n\n It was discovered that the Go net/http module incorrectly handled\n Transfer-Encoding headers in the HTTP/1 client. A remote attacker could\n possibly use this issue to perform an HTTP Request Smuggling attack.\n (CVE-2022-1705)\n \n It was discovered that Go did not properly manage memory under certain\n circumstances. An attacker could possibly use this issue to cause a panic\n resulting into a denial of service. (CVE-2022-1962, CVE-2022-27664,\n CVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632,\n CVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715,\n CVE-2022-41717, CVE-2023-24534, CVE-2023-24537)\n \n It was discovered that Go did not properly implemented the maximum size of\n file headers in Reader.Read. An attacker could possibly use this issue to\n cause a panic resulting into a denial of service. (CVE-2022-2879)\n \n It was discovered that the Go net/http module incorrectly handled query\n parameters in requests forwarded by ReverseProxy. A remote attacker could\n possibly use this issue to perform an HTTP Query Parameter Smuggling attack.\n (CVE-2022-2880)\n \n It was discovered that Go did not properly manage the permissions for\n Faccessat function. A attacker could possibly use this issue to expose\n sensitive information. (CVE-2022-29526)\n \n It was discovered that Go did not properly generate the values for\n ticket_age_add in session tickets. An attacker could possibly use this\n issue to observe TLS handshakes to correlate successive connections by\n comparing ticket ages during session resumption. (CVE-2022-30629)\n \n It was discovered that Go did not properly manage client IP addresses in\n net/http. An attacker could possibly use this issue to cause ReverseProxy\n to set the client IP as the value of the X-Forwarded-For header.\n (CVE-2022-32148)\n \n It was discovered that Go did not properly validate backticks (`) as\n Javascript string delimiters, and do not escape them as expected. An\n attacker could possibly use this issue to inject arbitrary Javascript code\n into the Go template. (CVE-2023-24538)\n","status":"published","published":"2024-01-09T13:08:13Z","modified":"2026-06-25T13:32:00.500319928Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}