toolchain vulnerabilities (Go)
34 vulnerabilities.
-
toolchainGo Checksum database bypass for golang.org/toolchain in cmd/go 7.8 High -
toolchainGo Checksum bypass for golang.org/fips140 in cmd/go 7.8 High -
toolchainGo Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog 8.4 High -
toolchainGo Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb 7.5 High -
toolchainGo Malicious module proxy can bypass checksum database in cmd/go 7.5 High -
toolchainGo Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go 5.3 Medium -
toolchainGo Invoking "go tool pack" does not sanitize output paths in cmd/go 5.9 Medium -
toolchainGo Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile 7.1 High -
toolchainGo Missing bound checks can lead to memory corruption in safe Go in cmd/compile 9.8 Critical -
toolchainGo Code execution vulnerability in SWIG code generation in cmd/go 8.8 High -
toolchainGo Potential code smuggling via doc comments in cmd/cgo 8.6 High -
toolchainGo Arbitrary file write using cgo pkg-config directive in cmd/go 7.8 High -
toolchainGo Unexpected code execution when invoking toolchain in cmd/go 7.0 High -
toolchainGo Unexpected command execution in untrusted VCS repositories in cmd/go 8.6 High -
toolchainGo Arbitrary code execution during build on darwin in cmd/go 7.5 High -
toolchainGo GOAUTH credential leak in cmd/go 8.8 High -
toolchainGo Output of "go env" does not sanitize values in cmd/go 9.8 Critical -
toolchainGo Arbitrary code execution during build on Darwin in cmd/go 6.4 Medium -
toolchainGo Command 'go get' may unexpectedly fallback to insecure git in cmd/go 7.5 High -
toolchainGo Arbitrary code execution during build via line directives in cmd/go 8.1 High -
toolchainGo Arbitrary code execution via go.mod toolchain directive in cmd/go 9.8 Critical -
toolchainGo Code injection via go command with cgo in cmd/go 9.8 Critical -
toolchainGo Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go 9.8 Critical -
toolchainGo Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go 9.8 Critical -
toolchainGo cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely... 7.5 High -
toolchainGo Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function... 9.8 Critical -
toolchainGo Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and... 7.5 High -
toolchainGo Arbitrary code execution via the go command with cgo in cmd/go 7.5 High -
toolchainGo Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo 7.5 High -
toolchainGo In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory... 6.8 Medium -
toolchainGo In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code... 7.5 High -
toolchainGo The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not... 8.8 High -
toolchainGo Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get"... 7.8 High -
toolchainGo Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom... 9.8 Critical