CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-14039 – openSUSE Security Advisory - openSUSE-SU-2020:1405-1
https://notcve.org/view.php?id=CVE-2020-14039
17 Jul 2020 — In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete. En Go versiones anteriores a 1.13.13 y versiones 1.14.x anteriores a 1.14.5, Certificate.Verify puede carecer de una comprobación en los requisitos VerifyOptions.KeyUsages EKU (si VerifyOptions.Roots es igual a cero y la instalación está en Windows). Entonc... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html • CWE-295: Improper Certificate Validation •
CVSS: 5.9EPSS: 0%CPEs: 10EXPL: 0CVE-2020-15586 – golang: data race in certain net/http servers including ReverseProxy can lead to DoS
https://notcve.org/view.php?id=CVE-2020-15586
17 Jul 2020 — Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. Go versiones anteriores a 1.13.13 y versiones 1.14.x anteriores a 1.14.5, presenta una carrera de datos en algunos servidores net/http, como es demostrado por el Manejador httputil.ReverseProxy, porque lee un cuerpo de petición y escribe una respuesta al mismo tiempo A flaw was found Go's net/http pa... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-14040 – golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
https://notcve.org/view.php?id=CVE-2020-14040
17 Jun 2020 — The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String. El paquete x/text anterior a la versión 0.3.3 para Go tiene una vulnerabilidad ... • https://groups.google.com/forum/#%21topic/golang-announce/bXVeAmGOqz0 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-7919 – Debian Security Advisory 4848-1
https://notcve.org/view.php?id=CVE-2020-7919
16 Mar 2020 — Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate. Go versiones anteriores a 1.12.16 y versiones 1.13.x anteriores a 1.13.7 (y el paquete crypto/cryptobyte versiones anteriores a 0.0.0-20200124225646-8b5121be2f68 para Go), permite ataques a los clientes (lo que resulta en un pánico) por medio de un certificado X.509 malformado. Multiple security issu... • https://groups.google.com/forum/#%21forum/golang-announce • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 9%CPEs: 2EXPL: 4CVE-2020-9283 – Go SSH servers 0.0.2 - Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2020-9283
20 Feb 2020 — golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client. golang.org/x/crypto versiones anteriores a v0.0.0-20200220183623-bac4c82f6975, para Go permite un pánico durante la comprobación de firma en el paquete golang.org/x/crypto/ssh. Un cliente puede atacar un servidor SSH que acepte claves públicas. Además, un ... • https://packetstorm.news/files/id/156480 • CWE-130: Improper Handling of Length Parameter Inconsistency CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2015-5741 – golang: HTTP request smuggling in net/http library
https://notcve.org/view.php?id=CVE-2015-5741
08 Feb 2020 — The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields. La biblioteca net/http en el archivo net/http/transfer.go en Go versiones anteriores a 1.4.3, no analiza apropiadamente los encabezados HTTP, lo que permite a atacantes remotos llevar a cabo ataques de tráfico no autorizado de peticiones HTTP por medio de un... • http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 8.1EPSS: 94%CPEs: 15EXPL: 36CVE-2020-0601 – Microsoft Windows CryptoAPI Spoofing Vulnerability
https://notcve.org/view.php?id=CVE-2020-0601
14 Jan 2020 — A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'. Se presenta una vulnerabilidad de suplantación de identidad en la manera en que Windows CryptoAPI (Crypt32.dll) comprueba los certificados Elliptic... • https://packetstorm.news/files/id/155960 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 4%CPEs: 18EXPL: 2CVE-2019-17596 – golang: invalid public key causes panic in dsa.Verify
https://notcve.org/view.php?id=CVE-2019-17596
24 Oct 2019 — Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates. Go versiones anteriores a 1.12.11 y versiones 1.3.x anteriores a 1.13.2, puede entrar en pánico tras intentar procesar el tráfico de red que contiene una clave pública DSA no válida. Existen varios escenarios de ataque, tal y como el tráfico de un cliente hacia un s... • https://github.com/pquerna/poc-dsa-verify-CVE-2019-17596 • CWE-295: Improper Certificate Validation CWE-436: Interpretation Conflict •
CVSS: 7.5EPSS: 9%CPEs: 14EXPL: 0CVE-2019-16276 – golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling
https://notcve.org/view.php?id=CVE-2019-16276
29 Sep 2019 — Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. Go versiones anteriores a 1.12.10 y versiones 1.13.x anteriores a 1.13.1, permitir el Trafico No Autorizado de Peticiones HTTP. It was discovered that net/http (through net/textproto) in golang does not correctly interpret HTTP requests where an HTTP header contains spaces before the colon. This could be abused by an attacker to smuggle HTTP requests when a proxy or a firewall is placed behind a server implemented in Go or to filter by... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 9.8EPSS: 4%CPEs: 3EXPL: 1CVE-2019-14809 – golang: malformed hosts in URLs leads to authorization bypass
https://notcve.org/view.php?id=CVE-2019-14809
13 Aug 2019 — net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com. net / url in Go antes del 1.11.13 y 1.12.x antes del 1.12.8 maneja mal los hosts mal formados en las URL, lo que lleva a un... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html • CWE-285: Improper Authorization •