CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-24789 – Mishandling of corrupt central directory record in archive/zip
https://notcve.org/view.php?id=CVE-2024-24789
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. El manejo que hace el paquete archive/zip de ciertos tipos de archivos zip no válidos difiere del comportamiento de la mayoría de las implementaciones zip. Esta desalineación podría aprovecharse para crear un archivo zip con contenidos que varían según la implementación que lea el archivo. • http://www.openwall.com/lists/oss-security/2024/06/04/1 https://go.dev/cl/585397 https://go.dev/issue/66869 https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7 https://pkg.go.dev/vuln/GO-2024-2888 https://access.redhat.com/security/cve/CVE-2024-24789 https://bugzilla.redhat.com/show_bug.cgi?id=2292668 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-24790 – Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
https://notcve.org/view.php?id=CVE-2024-24790
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. Los diversos métodos Is (IsPrivate, IsLoopback, etc.) no funcionaron como se esperaba para las direcciones IPv6 asignadas a IPv4, devolviendo falso para direcciones que devolverían verdadero en sus formas IPv4 tradicionales. A flaw was found in the Go language standard library net/netip. The method Is*() (IsPrivate(), IsPublic(), etc) doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to control access to resources or data. • http://www.openwall.com/lists/oss-security/2024/06/04/1 https://go.dev/cl/590316 https://go.dev/issue/67680 https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ https://pkg.go.dev/vuln/GO-2024-2887 https://access.redhat.com/security/cve/CVE-2024-24790 https://bugzilla.redhat.com/show_bug.cgi?id=2292787 • CWE-115: Misinterpretation of Input •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45285 – Command 'go get' may unexpectedly fallback to insecure git in cmd/go
https://notcve.org/view.php?id=CVE-2023-45285
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). El uso de go get para buscar un módulo con el sufijo ".git" puede recurrir inesperadamente al protocolo inseguro "git://" si el módulo no está disponible a través de "https://" y "git+ssh://" seguros, protocolos, incluso si GOINSECURE no está configurado para dicho módulo. Esto sólo afecta a los usuarios que no utilizan el proxy del módulo y están obteniendo módulos directamente (es decir, GOPROXY = desactivado). • https://go.dev/cl/540257 https://go.dev/issue/63845 https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G https://pkg.go.dev/vuln/GO-2023-2383 https://access.redhat.com/security/cve/CVE-2023-45285 https://bugzilla.redhat.com/show_bug.cgi?id=2253323 • CWE-693: Protection Mechanism Failure •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-39326 – Denial of service via chunk extensions in net/http
https://notcve.org/view.php?id=CVE-2023-39326
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. • https://go.dev/cl/547335 https://go.dev/issue/64433 https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G https://pkg.go.dev/vuln/GO-2023-2382 https://access.redhat.com/security/cve/CVE-2023-39326 https://bugzilla.redhat.com/show_bug.cgi?id=2253330 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45287 – Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
https://notcve.org/view.php?id=CVE-2023-45287
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels. Antes de Go 1.20, los intercambios de claves TLS basados en RSA utilizaban la librería math/big, que no es un tiempo constante. • https://go.dev/cl/326012/26 https://go.dev/issue/20654 https://groups.google.com/g/golang-announce/c/QMK8IQALDvA https://people.redhat.com/~hkario/marvin https://pkg.go.dev/vuln/GO-2023-2375 https://security.netapp.com/advisory/ntap-20240112-0005 https://access.redhat.com/security/cve/CVE-2023-45287 https://bugzilla.redhat.com/show_bug.cgi?id=2253193 • CWE-203: Observable Discrepancy CWE-208: Observable Timing Discrepancy •