Description
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go standard library | net/http/httputil | < 1.18.7, 1.19.0-0 – < 1.19.2 | 1.18.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | golang-1.19 | 1.19.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-1.13 | 1.13.8-1ubuntu2.22.04.2 | USN-6038-2 |
| Ubuntu 22.04 LTS | golang-1.17 | No fix yet | — |
| Ubuntu 22.04 LTS | golang-1.18 | 1.18.1-1ubuntu1.1 | USN-6038-1 |
| Ubuntu 20.04 LTS | golang-1.13 | 1.13.8-1ubuntu1.2 | USN-6038-2 |
| Ubuntu 20.04 LTS | golang-1.14 | No fix yet | — |
| Ubuntu 20.04 LTS | golang-1.16 | 1.16.2-0ubuntu1~20.04.1 | USN-6038-2 |
| Ubuntu 20.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~20.04.2 | USN-6038-1 |
| Ubuntu 18.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~18.04.4 | USN-6038-1 |
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | golang-1.13 | 1.13.8-1ubuntu1~18.04.4+esm1 | USN-6038-2 |
| Ubuntu Pro 18.04 LTS | golang-1.16 | 1.16.2-0ubuntu1~18.04.2+esm1 | USN-6038-2 |
| Ubuntu Pro 16.04 LTS | golang-1.13 | 1.13.8-1ubuntu1~16.04.3+esm3 | USN-6038-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | git-lfs | 3.2.0-1.el9 | RHSA-2023:2357 |
| RHEL 9 | golang +6 | 1.18.9-1.el9_1 | RHSA-2023:0328 |
| RHEL 9 | grafana | 9.0.9-2.el9 | RHSA-2023:2167 |
| RHEL 9 | osbuild-composer +3 | 76-2.el9_2 | RHSA-2023:2204 |
| RHEL 9 | weldr-client | 35.9-1.el9 | RHSA-2023:2204 |
| RHEL 8 | buildah +1 | 1:1.24.6-7.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | cockpit-podman | 46-1.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | conmon | 2:2.1.4-2.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | containernetworking-plugins | 1:1.1.1-6.module+el8.9.0+20875+8dd9d5d2 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | containers-common | 2:1-38.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | crit +4 | 3.15-3.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | crun | 1.8.7-1.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | delve | 1.8.3-1.module+el8.7.0+15126+0e0a42d9 | RHSA-2023:0446 |
| RHEL 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | git-lfs | 3.2.0-2.el8 | RHSA-2023:2866 |
| RHEL 8 | go-toolset | 1.18.9-1.module+el8.7.0+17845+708ebe87 | RHSA-2023:0446 |
| RHEL 8 | golang +6 | 1.18.9-1.module+el8.7.0+17640+84246675 | RHSA-2023:0446 |
| RHEL 8 | grafana | 7.5.15-4.el8 | RHSA-2023:2784 |
| RHEL 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+20326+387084d0 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | netavark +1 | 2:1.0.1-38.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | osbuild-composer +3 | 75-1.el8 | RHSA-2023:2780 |
| RHEL 8 | podman +6 | 2:4.0.2-25.module+el8.9.0+20875+8dd9d5d2 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | python-podman +1 | 4.0.0-2.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | runc | 1:1.1.5-2.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | skopeo +1 | 2:1.6.2-9.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | slirp4netns | 1.1.8-3.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | toolbox +1 | 0.0.99.4-5.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | udica | 0.2.6-4.module+el8.9.0+20656+56f336b9 | RHSA-2024:3254, RHSA-2024:2988, RHSA-2024:0121 |
| RHEL 8 | weldr-client | 35.9-2.el8 | RHSA-2023:2780 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Interconnect 1 | skupper-cli | 1.4.1-2.el8 | RHSA-2023:4003 |
| Red Hat Service Interconnect 1 | skupper-router +3 | 2.4.1-2.el8 | RHSA-2023:4003 |
| Red Hat Serverless 1 | openshift-serverless-clients | 1.6.1-1.el8 | RHSA-2023:0708 |
| Red Hat Openshift Ironic 4 | crudini | 0.9.3-4.el9 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | future | 0.18.2-9.el9.1 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | openstack-ironic +4 | 1:21.0.1-0.20221114235951.fe64d5e.el9 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | openstack-ironic-inspector +3 | 11.0.1-0.20221205155952.cd22607.el9 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | openstack-ironic-python-agent | 9.0.1-0.20220818145522.ad1eb41.el9 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | openstack-macros | 2020.1.2-1.el9 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | pyOpenSSL +1 | 20.0.1-2.el9.1 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | pyflakes | 2.2.0-3.el9.1 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | pysnmp | 4.4.12-6.el9 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | python-SecretStorage | 2.3.1-9.el9 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | python-alembic | 1.6.0-1.el9 | RHSA-2022:7398 |
| Red Hat Openshift Ironic 4 | python-amqp +1 | 5.0.6-1.el9 | RHSA-2022:7398 |
| Red Hat OpenStack 16 | etcd | 3.3.23-12.el8ost | RHSA-2023:1275 |
| Red Hat OpenShift 4 | NetworkManager +14 | 1:1.36.0-8.el8_6 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | afterburn +1 | 5.3.0-1.rhaos4.12.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | afterburn-dracut | 5.3.0-1.rhaos4.12.el9 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | ansible-runner +1 | 1.4.6-2.el8ar | RHSA-2022:7398 |
| Red Hat OpenShift 4 | ansible-runner-http | 1.0.0-2.el8ar | RHSA-2022:7398 |
| Red Hat OpenShift 4 | atomic-openshift-service-idler | 4.12.0-202210141624.p0.ga0f9090.assembly.stream.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | bootupd +1 | 0.2.5-3.rhaos4.12.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.23.4-2.el8 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | butane +1 | 0.16.0-2.rhaos4.12.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | conmon | 2:2.1.2-2.rhaos4.11.el8 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | conmon-rs | 0.4.0-2.rhaos4.12.git.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | console-login-helper-messages +2 | 0.20.4-1.rhaos4.12.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | container-selinux | 2:2.188.0-1.rhaos4.12.el8 | RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | containernetworking-plugins | 1.0.1-5.rhaos4.11.el8 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | containers-common | 2:1-27.rhaos4.12.el8 | RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | coreos-installer +1 | 0.16.1-1.rhaos4.12.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | coreos-installer-dracut | 0.16.1-1.rhaos4.12.el9 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | cri-o | 1.25.1-5.rhaos4.12.git6005903.el8 | RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | cri-tools | 1.25.0-2.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | crit +4 | 3.15-4.rhaos4.11.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | crudini | 0.9-11.el8ost.1 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | crun | 1.4.2-1.rhaos4.11.el8 | RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | fuse-overlayfs | 1.9-1.rhaos4.11.el8 | RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | grpc +4 | 1.18.0-4.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | haproxy +1 | 2.2.24-1.el8 | RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | ignition +1 | 2.14.0-5.rhaos4.12.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | kata-containers | 2.5.2-1.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | kernel-rt +15 | 4.18.0-372.40.1.rt7.197.el8_6 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | libslirp +1 | 4.4.0-2.rhaos4.11.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | nmstate +4 | 1.3.3-1.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | openshift +1 | 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el8 | RHSA-2023:3613, RHSA-2022:7398 |
| Red Hat OpenShift 4 | openshift-ansible +1 | 4.12.0-202211071957.p0.g3a9d20e.assembly.stream.el8 | RHSA-2023:3613, RHSA-2022:7398 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.12.0-202301042257.p0.g854f807.assembly.stream.el8 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | openshift-kuryr +4 | 4.12.0-202210261235.p0.g92b9be2.assembly.stream.el8 | RHSA-2023:3613, RHSA-2022:7398 |
| Red Hat OpenShift 4 | openshift4-aws-iso | 4.12.0-202306090942.p0.gd2acdd5.assembly.stream.el8 | RHSA-2023:3613 |
| Red Hat OpenShift 4 | openvswitch2.17 +5 | 2.17.0-62.el8fdp | RHSA-2022:7398 |
| Red Hat OpenShift 4 | ostree +3 | 2022.2-5.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | ovn22.06 +3 | 22.06.0-27.el8fdp | RHSA-2022:7398 |
| Red Hat OpenShift 4 | ovn22.09 +3 | 22.09.0-25.el8fdp | RHSA-2022:7398 |
| Red Hat OpenShift 4 | perf +30 | 4.18.0-372.59.1.el8_6 | RHSA-2023:3613 |
| Red Hat OpenShift 4 | podman +5 | 2:4.2.0-1.rhaos4.12.el8 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | podman-gvproxy | 3:4.2.0-4.rhaos4.12.el9 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | pycdlib-tools +2 | 1.11.0-3.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-alembic +1 | 1.4.2-5.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-amqp +2 | 2.5.2-7.el8ost.1 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-cmd2 +1 | 1.4.0-1.1.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-construct +1 | 2.10.56-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-dogpile-cache +1 | 1.1.2-1.el8ost.1 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-eventlet +1 | 0.30.2-1.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-flask +2 | 1:1.1.1-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-funcsigs +2 | 1.0.2-8.el8ost.1 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-gunicorn +1 | 19.9.0-10.el8ost.1 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-ifaddr +1 | 0.1.6-5.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-importlib-metadata +1 | 1.7.0-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-iso8601 +1 | 0.1.12-8.el8ost.1 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-jsonschema +1 | 3.2.0-5.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-kombu +1 | 1:4.6.6-7.el8ost.1 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-kubernetes +2 | 25.3.0-1.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-lockfile +1 | 1:0.11.0-8.el8ar | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-msgpack +1 | 0.6.2-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-config +1 | 2:8.7.1-0.20211012155707.1a7bd66.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-context +2 | 3.3.1-0.20211012152439.641a1e0.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-db +3 | 9.1.0-0.20211020204148.be2cc6a.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-i18n +2 | 5.1.0-0.20211012165753.b031d17.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-log +3 | 4.6.0-0.20211012154701.41c8807.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-messaging +2 | 12.9.1-0.20211020204149.f9de265.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-metrics +2 | 0.3.0-0.20211020174122.43eee50.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-policy +3 | 3.8.2-0.20211012161944.c7fd9f4.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-oslo-serialization +2 | 4.2.0-0.20211012151454.2b94a4f.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-packaging +2 | 20.4-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-paste +1 | 3.2.4-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-paste-deploy +1 | 2.0.1-4.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-pexpect +1 | 4.6-2.el8ar | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-pint +1 | 0.10.1-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-pyghmi +1 | 1.5.14-2.1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-pyperclip +2 | 1.6.4-6.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-pyroute2 +1 | 0.5.13-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-pyrsistent +1 | 0.16.0-3.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-requests-unixsocket +1 | 0.1.5-5.el8ar | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-rsa +1 | 4.7-1.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-tenacity +1 | 6.2.0-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-wcwidth +1 | 0.1.7-14.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-werkzeug +1 | 1.0.1-3.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-zeroconf +1 | 0.24.4-1.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | python-zipp +1 | 0.5.1-2.el8ost | RHSA-2022:7398 |
| Red Hat OpenShift 4 | rpm-ostree +2 | 2022.10.99.g0049dbdd-3.el8 | RHSA-2022:7398 |
| Red Hat OpenShift 4 | runc | 3:1.1.2-2.rhaos4.12.el8 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.8.0-1.rhaos4.12.el8 | RHSA-2023:3613, RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | slirp4netns | 1.1.8-1.rhaos4.11.el8 | RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat OpenShift 4 | tini | 0.16.1-1.el8ar | RHSA-2022:7398 |
| Red Hat OpenShift 4 | toolbox | 0.1.0-1.rhaos4.12.el8 | RHSA-2023:0727, RHSA-2022:7398 |
| Red Hat Devtools 2022 | go-toolset-1.18 +10 | 1.18.9-1.el7_9 | RHSA-2023:0445 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | git-lfs | 3.2.0-1.el9 | ALSA-2023:2357 |
| AlmaLinux 9 | golang +7 | 1.18.9-1.el9_1 | ALSA-2023:0328 |
| AlmaLinux 9 | grafana | 9.0.9-2.el9 | ALSA-2023:2167 |
| AlmaLinux 9 | osbuild-composer +3 | 76-2.el9_2.alma | ALSA-2023:2204 |
| AlmaLinux 9 | weldr-client | 35.9-1.el9 | ALSA-2023:2204 |
| AlmaLinux 8 | buildah +1 | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | cockpit-podman | 46-1.module_el8.7.0+3344+5bcd850f | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | conmon | 2:2.1.4-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | container-selinux | 2:2.205.0-3.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.1.1-6.module_el8.9.0+3711+04fcca5e | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | containers-common | 2:1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | crit +4 | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | crun | 1.8.7-1.module_el8.9.0+3683+33eb0feb | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | delve | 1.8.3-1.module_el8.7.0+3280+24dc9c5d | ALSA-2023:0446 |
| AlmaLinux 8 | fuse-overlayfs | 1.9-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | git-lfs | 3.2.0-2.el8 | ALSA-2023:2866 |
| AlmaLinux 8 | golang +7 | 1.18.9-1.module_el8.7.0+3397+4350156d | ALSA-2023:0446 |
| AlmaLinux 8 | grafana | 7.5.15-4.el8 | ALSA-2023:2784 |
| AlmaLinux 8 | libslirp +1 | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | netavark +1 | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module_el8.8.0+3468+16b86c82 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | osbuild-composer +3 | 75-1.el8.alma | ALSA-2023:2780 |
| AlmaLinux 8 | podman +6 | 2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | python3-podman | 4.0.0-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | runc | 1:1.1.5-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | skopeo +1 | 2:1.6.2-9.module_el8.9.0+3687+dcd7ef8f.alma.1 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | slirp4netns | 1.1.8-3.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | toolbox +1 | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | udica | 0.2.6-4.module_el8.9.0+3627+db8ec155 | ALSA-2024:3254, ALSA-2024:0121 |
| AlmaLinux 8 | weldr-client | 35.9-2.el8 | ALSA-2023:2780 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | golang +1 | 1.18.9-1.el9_1 | RLSA-2023:0328 |
| Rocky Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | buildah | 1:1.24.6-7.module+el8.9.0+1445+07728297 | RLSA-2024:0121 |
| Rocky Linux 8 | cockpit-podman | 46-1.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | conmon | 2:2.1.4-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | containers-common | 2:1-38.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | criu | 3.15-3.module+el8.9.0+1445+07728297 | RLSA-2024:0121 |
| Rocky Linux 8 | crun | 1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | delve | 1.8.3-1.module+el8.7.0+1073+99e3b3cd | RLSA-2023:0446 |
| Rocky Linux 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | golang +1 | 1.18.9-1.module+el8.7.0+1133+56289a01 | RLSA-2023:0446 |
| Rocky Linux 8 | libslirp | 4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | python-podman | 4.0.0-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | runc | 1:1.1.5-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | skopeo | 2:1.6.2-9.module+el8.9.0+1578+aa900b44 | RLSA-2024:0121 |
| Rocky Linux 8 | slirp4netns | 1.1.8-3.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0121 |
| Rocky Linux 8 | toolbox | 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:2988 |
| Rocky Linux 8 | udica | 0.2.6-4.module+el8.9.0+1445+07728297 | RLSA-2024:0121 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | go1.18 | 1.18.7-150000.1.34.1 | SUSE-SU-2022:3668-1 |
| SLES 15 SP4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLES 15 SP4 | go1.19 | 1.19.2-150000.1.12.1 | SUSE-SU-2022:3669-1 |
| SLES 15 SP3 | go1.18 | 1.18.7-150000.1.34.1 | SUSE-SU-2022:3668-1 |
| SLES 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLES 15 SP3 | go1.19 | 1.19.2-150000.1.12.1 | SUSE-SU-2022:3669-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLE Real Time 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLE HPC 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SUSE Enterprise Storage 7.1 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.18 | 1.18.7-1.1 | openSUSE-SU-2024:12391-1 |
| openSUSE Tumbleweed | go1.19 | 1.19.2-1.1 | openSUSE-SU-2024:12392-1 |
| openSUSE Leap 15.5 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| openSUSE Leap 15.4 | go1.18 | 1.18.7-150000.1.34.1 | SUSE-SU-2022:3668-1 |
| openSUSE Leap 15.4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| openSUSE Leap 15.4 | go1.19 | 1.19.2-150000.1.12.1 | SUSE-SU-2022:3669-1 |
| openSUSE Leap 15.3 | go1.18 | 1.18.7-150000.1.34.1 | SUSE-SU-2022:3668-1 |
| openSUSE Leap 15.3 | go1.19 | 1.19.2-150000.1.12.1 | SUSE-SU-2022:3669-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.19.2-r0 | — |
| Alpine v3.23 | go | 1.19.2-r0 | — |
| Alpine v3.22 | go | 1.19.2-r0 | — |
| Alpine v3.21 | go | 1.19.2-r0 | — |
| Alpine v3.20 | go | 1.19.2-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | go | 1.19.2-r0 | — |
| Alpine v3.18 | go | 1.19.2-r0 | — |
| Alpine v3.17 | go | 1.19.2-r0 | — |
| Alpine v3.16 | go | 1.18.7-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | golang +7 | 1.19.8-1.amzn2023.0.1 | ALAS2023-2023-175 |
| Amazon Linux 2 | golang +7 | 1.18.9-1.amzn2.0.2 | ALAS2-2023-2015 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | golang | 1.19.10-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | cockpit-composer | 45-1.0.1.el9_2 | ELSA-2023-2204 |
| Oracle Linux 9 | git-lfs | 3.2.0-1.el9 | ELSA-2023-2357 |
| Oracle Linux 9 | golang +7 | 1.18.9-1.el9_1 | ELSA-2023-0328 |
| Oracle Linux 9 | grafana | 9.0.9-2.el9 | ELSA-2023-2167 |
| Oracle Linux 9 | osbuild +5 | 81-1.el9 | ELSA-2023-2204 |
| Oracle Linux 9 | osbuild-composer +3 | 76-2.el9_2 | ELSA-2023-2204 |
| Oracle Linux 9 | weldr-client | 35.9-1.el9 | ELSA-2023-2204 |
| Oracle Linux 8 | buildah +1 | 1:1.24.6-7.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | cockpit-composer | 45-1.0.1.el8_8 | ELSA-2023-2780 |
| Oracle Linux 8 | cockpit-podman | 46-1.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | conmon | 2:2.1.4-2.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.1.1-6.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | containers-common | 2:1-38.0.1.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | crit +4 | 3.15-3.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | crun | 1.8.7-1.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | delve | 1.8.3-1.0.1.module+el8.7.0+20775+f27162c3 | ELSA-2023-18908, ELSA-2023-0446, ELSA-2022-24267 |
| Oracle Linux 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | git-lfs | 3.2.0-2.el8 | ELSA-2023-2866 |
| Oracle Linux 8 | go-toolset | 1.18.8-1.module+el8.7.0+20882+f24d347b | ELSA-2023-18908, ELSA-2023-0446, ELSA-2022-24267 |
| Oracle Linux 8 | golang +6 | 1.18.8-1.0.1.module+el8.7.0+20882+f24d347b | ELSA-2023-18908, ELSA-2023-0446, ELSA-2022-24267 |
| Oracle Linux 8 | grafana | 7.5.15-4.el8 | ELSA-2023-2784 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | netavark +1 | 2:1.0.1-38.0.1.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | osbuild +5 | 81-1.el8 | ELSA-2023-2780 |
| Oracle Linux 8 | osbuild-composer +3 | 75-1.el8 | ELSA-2023-2780 |
| Oracle Linux 8 | podman +6 | 2:4.0.2-25.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | python3-podman | 4.0.0-2.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | runc | 1:1.1.5-2.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | skopeo +1 | 2:1.6.2-9.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | slirp4netns | 1.1.8-3.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | udica | 0.2.6-4.module+el8.9.0+90119+2f9ef15c | ELSA-2024-3254, ELSA-2024-2988, ELSA-2024-0121 |
| Oracle Linux 8 | weldr-client | 35.9-2.el8 | ELSA-2023-2780 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.18.7 · >= 1.19.0-0, < 1.19.2 | 1.18.7, 1.19.2 | GO-2022-1038 |
Advisories 50
- ALSA-2023:0328 Moderate: go-toolset and golang security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2357 Moderate: git-lfs security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2204 Moderate: Image Builder security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2167 Moderate: grafana security and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0121 Moderate: container-tools:4.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3254 Important: container-tools:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2866 Moderate: git-lfs security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2780 Moderate: Image Builder security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2784 Moderate: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:0446 Moderate: go-toolset:rhel8 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:3254 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:2988 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:0121 Red Hat Security Advisory: container-tools:4.0 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:4003 Red Hat Security Advisory: Red Hat Service Interconnect 1.4 Release security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:0727 Red Hat Security Advisory: OpenShift Container Platform 4.12.3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2022:7398 Red Hat Security Advisory: OpenShift Container Platform 4.12.0 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:1275 Red Hat Security Advisory: Red Hat OpenStack Platform (etcd) security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2023:3613 Red Hat Security Advisory: OpenShift Container Platform 4.12.22 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2866 Red Hat Security Advisory: git-lfs security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2780 Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2357 Red Hat Security Advisory: git-lfs security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2204 Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:0446 Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:0328 Red Hat Security Advisory: go-toolset and golang security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2784 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:2167 Red Hat Security Advisory: grafana security and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0708 Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.27.0 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0445 Red Hat Security Advisory: go-toolset-1.18 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- USN-6038-2 golang-1.13, golang-1.16 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-6038-1 golang-1.18 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- RLSA-2023:0446 Moderate: go-toolset:rhel8 security and bug fix update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2023:0328 Moderate: go-toolset and golang security and bug fix update Rocky Linux Security Advisories · Feb 5, 2026
- openSUSE-SU-2024:12392-1 go1.19-1.19.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2312-1 Security update for go1.18-openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3669-1 Security update for go1.19 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12391-1 go1.18-1.18.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
- ALAS2-2023-2015 Important: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 23, 2025
- RLSA-2024:2988 Moderate: container-tools:rhel8 security update Rocky Linux Security Advisories · May 7, 2025
- RLSA-2024:0121 Moderate: container-tools:4.0 security update Rocky Linux Security Advisories · May 7, 2025
- SUSE-SU-2022:3668-1 Security update for go1.18 SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-0318 Red Hat Migration Toolkit for Containers: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 29, 2025
- WID-SEC-2023-0111 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2024
- ELSA-2024-3254 Important: container-tools:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 29, 2024
- ELSA-2024-2988 Moderate: container-tools:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2024
- SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024