golang-1.19 vulnerabilities (Debian)
143 vulnerabilities.
golang-1.19DebianHTTP/1 server crash due to MaxBytesReader header race in net/httpNo scoregolang-1.19DebianUnexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compileNo scoregolang-1.19DebianLinker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/linkNo scoregolang-1.19DebianHost linker flag injection via //go:cgo_* directives in cmd/compile and cmd/linkNo scoregolang-1.19DebianCgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/linkNo scoregolang-1.19DebianFlag sanitization bypass via "#cgo pkg-config:" directives in cmd/goNo scoregolang-1.19DebianArbitrary code execution via crafted .syso files and cgo linker input files in cmd/goNo scoregolang-1.19DebianLinker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/goNo scoregolang-1.19DebianArbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/goNo scoregolang-1.19DebianUnexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/goNo scoregolang-1.19DebianArbitrary command execution via GCC spec files in cgo linker search directories in cmd/goNo scoregolang-1.19DebianUnexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/goNo scoregolang-1.19DebianDistrust compromised intermediate certificates in crypto/x5096.8 Mediumgolang-1.19DebianHTTP/2 server crash due to HPACK encoder race in net/http7.5 Highgolang-1.19DebianReject malformed ECH outer extension references in crypto/tls7.5 Highgolang-1.19DebianRecognize yield as regexp preceder keyword in html/template6.1 Mediumgolang-1.19DebianReset context tracking on consecutive template expressions in html/template6.1 Mediumgolang-1.19DebianChecksum database bypass for golang.org/toolchain in cmd/go7.8 Highgolang-1.19DebianChecksum bypass for golang.org/fips140 in cmd/go7.8 Highgolang-1.19DebianMemory limit bypass when parsing MIME headers in net/textproto, mime/multipart7.5 Highgolang-1.19DebianHTTP/1 server connection desynchronization after 2xx CONNECT response in net/http7.5 Highgolang-1.19DebianExcessive CPU consumption from repeated initial window changes in net/http7.5 Highgolang-1.19DebianLack of limit on size of parsed Range headers in net/http7.5 Highgolang-1.19DebianDouble flow control refund on HTTP/2 server streams in net/http9.1 Criticalgolang-1.19DebianHTTP/2 transport accepts malformed framing-related headers in net/http7.5 Highgolang-1.19DebianHTTP/2 server memory exhaustion due to Trailer headers in net/http7.5 Highgolang-1.19DebianHTTP/1 client connection desynchronization after CONNECT rejection in net/http7.5 Highgolang-1.19DebianFix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog8.4 Highgolang-1.19DebianIgnore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb7.5 Highgolang-1.19DebianLimit handshake messages we are willing to accept post-handshake in crypto/tls7.5 Highgolang-1.19DebianAvoid quadratic complexity in resolvePath in net/url5.9 Mediumgolang-1.19DebianAdd recursion depth guard during decode in encoding/xml7.5 Highgolang-1.19DebianFix Javascript regexp context tracking in html/template6.1 Mediumgolang-1.19DebianApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http7.5 Highgolang-1.19DebianEnforce maximum recursion depth in encoding/asn17.5 Highgolang-1.19DebianArbitrary inputs are included in errors without any escaping in net/textproto5.3 Mediumgolang-1.19DebianQuadratic complexity in WordDecoder.DecodeHeader in mime7.5 Highgolang-1.19DebianInefficient candidate hostname parsing in crypto/x5096.5 Mediumgolang-1.19DebianMalicious module proxy can bypass checksum database in cmd/go7.5 Highgolang-1.19DebianQuadratic string concatenation in consumePhrase in net/mail7.5 Highgolang-1.19DebianEscaper bypass leads to XSS in html/template6.1 Mediumgolang-1.19DebianReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil5.3 Mediumgolang-1.19DebianBypass of meta content URL escaping causes XSS in html/template6.1 Mediumgolang-1.19DebianQuadratic string concatentation in consumeComment in net/mail7.5 Highgolang-1.19DebianInvoking "go bug" follows symlinks in predictable temporary filenames in cmd/go5.3 Mediumgolang-1.19DebianInvoking "go tool pack" does not sanitize output paths in cmd/go5.9 Mediumgolang-1.19DebianCrash when handling long CNAME response in net7.5 Highgolang-1.19DebianJsBraceDepth Context Tracking Bugs (XSS) in html/template6.1 Mediumgolang-1.19DebianUnbounded allocation for old GNU sparse in archive/tar5.5 Mediumgolang-1.19DebianUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls7.5 High- Show olderLoading…