gh vulnerabilities (Azure Linux)
60 vulnerabilities.
-
ghAzure Linux Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net No score -
ghAzure Linux Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net No score -
ghAzure Linux compress zstd: Panic on two-block frames 8.7 High -
ghAzure Linux HTTP/2 server crash due to HPACK encoder race in net/http 7.5 High -
ghAzure Linux Excessive CPU consumption from repeated initial window changes in net/http 7.5 High -
ghAzure Linux Double flow control refund on HTTP/2 server streams in net/http 9.1 Critical -
ghAzure Linux HTTP/2 transport accepts malformed framing-related headers in net/http 7.5 High -
ghAzure Linux HTTP/2 server memory exhaustion due to Trailer headers in net/http 7.5 High -
ghAzure Linux gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers 8.7 High -
ghAzure Linux Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh 7.5 High -
ghAzure Linux Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh 7.5 High -
ghAzure Linux gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation 8.7 High -
ghAzure Linux GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default 2.1 Low -
ghAzure Linux GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching 2.1 Low -
ghAzure Linux GitHub CLI: Terminal escape sequence injection in multiple `gh` commands 5.3 Medium -
ghAzure Linux GitHub CLI: Unescaped variable components in request URLs could allow path traversal 5.1 Medium -
ghAzure Linux GitHub CLI: Partial token disclosure in `gh auth status` output 3.3 Low -
ghAzure Linux sigstore-go fails to check signature timestamps against a signing key's validity period 3.1 Low -
ghAzure Linux Infinite loop on invalid input in golang.org/x/text 7.5 High -
ghAzure Linux GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace 4.4 Medium -
ghAzure Linux go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware 6.9 Medium -
ghAzure Linux Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
ghAzure Linux Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
ghAzure Linux Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
ghAzure Linux Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
ghAzure Linux Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
ghAzure Linux Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh 7.5 High -
ghAzure Linux Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh 5.3 Medium -
ghAzure Linux Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh 9.1 Critical -
ghAzure Linux Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh 9.1 Critical -
ghAzure Linux Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh 7.5 High -
ghAzure Linux Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh 6.3 Medium -
ghAzure Linux Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh 6.5 Medium -
ghAzure Linux gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection 3.5 Low -
ghAzure Linux goldmark vulnerable to Cross-site Scripting (XSS) 5.1 Medium -
ghAzure Linux Unbounded allocation for old GNU sparse in archive/tar 5.5 Medium -
ghAzure Linux Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL 5.3 Medium -
ghAzure Linux go-tuf improperly validates the configured threshold for delegations 5.9 Medium -
ghAzure Linux go-tuf affected by client DoS via malformed server response 5.9 Medium -
ghAzure Linux Infinite parsing loop in golang.org/x/net 5.3 Medium -
ghAzure Linux Unbounded allocation when parsing GNU sparse map in archive/tar 4.3 Medium -
ghAzure Linux Quadratic parsing complexity in golang.org/x/net/html 5.3 Medium -
ghAzure Linux Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure 5.3 Medium -
ghAzure Linux Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server 2.6 Low -
ghAzure Linux Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net 6.5 Medium -
ghAzure Linux Potential denial of service in golang.org/x/crypto 7.5 High -
ghAzure Linux Go JOSE's Parsing Vulnerable to Denial of Service 6.6 Medium -
ghAzure Linux `gh attestation verify` returns incorrect exit code during verification if no attestations are present 6.3 Medium -
ghAzure Linux Non-linear parsing of case-insensitive content in golang.org/x/net/html 5.3 Medium -
ghAzure Linux Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto 9.1 Critical - Show olderLoading…