golang-1.7 - security update

Fixed packages 1

Vulnerabilities 7

• High 7.5
  CVE-2018-16873 EPSS 66%

  Remote command execution via "go get" with "-u" flag in cmd/go

  In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is on…

  [UNKNOWN] golang golang-1.8 golang-1.10 Ubuntu Go
  Dec 14, 2018
• Medium 6.8
  CVE-2018-16874

  Directory traversal via "go get" command in cmd/go

  In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable…

  [UNKNOWN] golang golang-1.8 golang-1.10 Ubuntu Go
  Dec 14, 2018
• Unscored —
  CVE-2017-15041

  Remote command execution via "go get" in cmd/go

  Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Sub…

  golang-1.8 golang-1.6 toolchain Ubuntu Go
  Oct 5, 2017
• Unscored —
  CVE-2019-16276

  Request smuggling due to accepting invalid headers in net/http via net/textproto

  Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

  go stdlib golang-1.8 golang-1.10 Ubuntu Alpine Go
  Sep 30, 2019
• Unscored —
  CVE-2019-17596 Public exploit

  Panic on invalid DSA public keys in crypto/dsa

  Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

  golang go stdlib golang-1.8 Ubuntu Azure Linux Alpine Go
  Oct 24, 2019
• Unscored —
  CVE-2019-9741

  An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, …

  golang-1.8 golang-1.10 golang-1.6 golang-1.9 Ubuntu Azure Linux
  Mar 13, 2019
• Unscored —
  CVE-2021-3114

  Incorrect operations on the P-224 curve in crypto/elliptic

  In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Jan 26, 2021