Skip to content
OpenAdvisories
High ELSA-2022-17957 4 CVEs

Important: ol8addon security update (Oracle Linux 8)

Published Jul 12, 2022 · Updated Jul 12, 2022

Ecosystem: Oracle Linux

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 8 delve 0:1.7.2-1.0.1.module+el8.6.0+20703+24a110ad
Oracle Linux · 8 go-toolset 0:1.17.11-1.module+el8.6.0+20703+24a110ad
Oracle Linux · 8 golang 0:1.17.11-1.0.1.module+el8.6.0+20703+24a110ad
Oracle Linux · 8 golang-bin 0:1.17.11-1.0.1.module+el8.6.0+20703+24a110ad
Oracle Linux · 8 golang-docs 0:1.17.11-1.0.1.module+el8.6.0+20703+24a110ad
Oracle Linux · 8 golang-misc 0:1.17.11-1.0.1.module+el8.6.0+20703+24a110ad
Oracle Linux · 8 golang-race 0:1.17.11-1.0.1.module+el8.6.0+20703+24a110ad
Oracle Linux · 8 golang-src 0:1.17.11-1.0.1.module+el8.6.0+20703+24a110ad
Oracle Linux · 8 golang-tests 0:1.17.11-1.0.1.module+el8.6.0+20703+24a110ad

Vulnerabilities 4

  • High 7.8
    CVE-2022-30580

    Empty Cmd.Path can trigger unintended binary in os/exec on Windows

    Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

    Go standard library os/exec golang go Azure Linux Alpine Go
  • Unscored —
    CVE-2022-29804

    Path traversal via Clean on Windows in path/filepath

    Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

    Go standard library path/filepath golang go Azure Linux Alpine Go
  • Unscored —
    CVE-2022-30269

    Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installatio…

  • Unscored —
    CVE-2022-30634

    Indefinite hang with large buffers on Windows in crypto/rand

    Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

    Go standard library crypto/rand golang go Ubuntu Azure Linux Alpine Go