osbuild-composer vulnerabilities (TuxCare)
25 vulnerabilities.
osbuild-composerTuxCareLimit handshake messages we are willing to accept post-handshake in crypto/tls7.5 Highosbuild-composerTuxCareAvoid quadratic complexity in resolvePath in net/url5.9 Mediumosbuild-composerTuxCareAdd recursion depth guard during decode in encoding/xml7.5 Highosbuild-composerTuxCareFix Javascript regexp context tracking in html/template6.1 Mediumosbuild-composerTuxCareEnforce maximum recursion depth in encoding/asn17.5 Highosbuild-composerTuxCareEcho: Encoded slash (%2F) bypasses route-level protection and exposes static files7.5 Highosbuild-composerTuxCareQuadratic complexity in WordDecoder.DecodeHeader in mime7.5 Highosbuild-composerTuxCareInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html6.1 Mediumosbuild-composerTuxCareInvoking duplicate attributes can cause XSS in golang.org/x/net/html6.1 Mediumosbuild-composerTuxCareInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html6.1 Mediumosbuild-composerTuxCareQuadratic string concatenation in consumePhrase in net/mail7.5 Highosbuild-composerTuxCareQuadratic string concatentation in consumeComment in net/mail7.5 Highosbuild-composerTuxCareUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls7.5 Highosbuild-composerTuxCareTOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix6.4 Mediumosbuild-composerTuxCareInefficient policy validation in crypto/x5097.5 Highosbuild-composerTuxCareUnexpected work during chain building in crypto/x5097.5 Highosbuild-composerTuxCareGo JOSE affect by a panic in JWE decryption7.5 Highosbuild-composerTuxCareDenial of service in github.com/jackc/pgproto3/v27.5 Highosbuild-composerTuxCareIncorrect parsing of IPv6 host literals in net/url7.5 Highosbuild-composerTuxCareUnexpected session resumption in crypto/tls10.0 Criticalosbuild-composerTuxCareExcessive CPU consumption when building archive index in archive/zip6.5 Mediumosbuild-composerTuxCareMemory exhaustion in query parameter parsing in net/url7.5 Highosbuild-composerTuxCareExcessive resource consumption when printing error string for host certificate validation in crypto/x5097.5 Highosbuild-composerTuxCareGo JOSE's Parsing Vulnerable to Denial of Service6.6 Mediumosbuild-composerTuxCareInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna9.6 Critical