Unscored DLA-2460-1 3 CVEs

golang-1.8 - security update

Published Nov 21, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	golang-1.8	1.8.1-1+deb9u2

Vulnerabilities 3

Unscored —

CVE-2020-15586

Data race and crash in net/http

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

Jul 17, 2020
Unscored —

CVE-2020-16845

Unbounded read from invalid inputs in encoding/binary

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

Aug 6, 2020
Unscored —

CVE-2020-28367

Arbitrary code execution via the go command with cgo in cmd/go

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

Go toolchain cmd/go go golang-1.8 Debian Ubuntu Alpine Go

Nov 18, 2020