guac

48 results · Clear filters · Feed

• Medium 4.3
  CVE-2024-34155

  Stack exhaustion in all Parse functions in go/parser

  Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

  Go standard library go/parser katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• Medium 6.0
  CVE-2024-6104

  go-retryablehttp can leak basic auth credentials to log files

  go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

  HashiCorp Shared library zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jun 24, 2024
• Medium 5.5
  CVE-2024-35255

  Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

  Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

  Microsoft Azure Identity Library for .NET Microsoft Authentication Library Azure Identity Library Azure Linux Wolfi npm Maven PyPI Go NuGet
  Jun 11, 2024
• Medium 6.4
  CVE-2024-24787 Public exploit

  Arbitrary code execution during build on Darwin in cmd/go

  On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

  Go toolchain cmd/go katib-suggestion-hyperopt katib-earlystopping Azure Linux Wolfi Go
  May 8, 2024
• Medium 5.9
  CVE-2024-24788

  Malformed DNS message can cause infinite loop in net

  A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

  Go standard library net golang go Ubuntu Azure Linux Alpine Wolfi Go
  May 8, 2024
• Medium 4.3
  CVE-2024-28180

  Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

  Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

  go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go
  Mar 9, 2024
• Medium 6.9
  CVE-2024-24557

  Moby classic builder cache poisoning

  Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONB…

  moby moby katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 1, 2024
• Medium 5.3
  CVE-2024-23650

  BuildKit possible panic when incorrect parameters sent from frontend

  BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been f…

  moby BuildKit zot kubescape Ubuntu Azure Linux Alpine Wolfi Go
  Jan 31, 2024