CVSS: 8.1EPSS: 16%CPEs: 8EXPL: 0CVE-2016-5386 – Go: sets environmental variable based on user supplied Proxy request header
https://notcve.org/view.php?id=CVE-2016-5386
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. El paquete net/http en Go hasta la versión 1.6 no intenta abordar los conflictos de espacio de nombres de RFC 3875 sección 4.1.18 y por lo tanto no protege aplicaciones CGI de la presencia de datos de clientes no confiables en ambiente variable de HTTP_PROXY, lo que podría permitir a atacantes remotos redireccionar el tráfico HTTP saliente de una aplicación CGI a un servidor proxy arbitrario a través de una cabecera Proxy manipulada en una petición HTTP, también conocido como un problema "httpoxy". An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable "HTTP_PROXY" using the incoming "Proxy" HTTP-request header. The environment variable "HTTP_PROXY" is used by numerous web clients, including Go's net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack. • http://rhn.redhat.com/errata/RHSA-2016-1538.html http://www.kb.cert.org/vuls/id/797896 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html https://bugzilla.redhat.com/show_bug.cgi?id=1353798 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us https://httpoxy.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproje • CWE-20: Improper Input Validation CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-3958
https://notcve.org/view.php?id=CVE-2016-3958
Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function. Vulnerabilidad de búsqueda de ruta no confiable en Go en versiones anteriores a 1.5.4 y 1.6.x en versiones anteriores a 1.6.1 en Windows permite a usuarios locales obtener privilegios a través de un troyano DLL en el directorio de trabajo actual, relacionado con el uso de la función LoadLibrary. • http://www.openwall.com/lists/oss-security/2016/04/05/1 http://www.openwall.com/lists/oss-security/2016/04/05/2 https://github.com/golang/go/issues/14959 https://go-review.googlesource.com/#/c/21428 https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 2%CPEs: 6EXPL: 0CVE-2016-3959 – golang: infinite loop in several big integer routines
https://notcve.org/view.php?id=CVE-2016-3959
The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries. La función Verify en crypto/dsa/dsa.go en Go en versiones anteriores a 1.5.4 y 1.6.x en versiones anteriores a 1.6.1 no comprueba correctamente los parámetros pasados a la gran librería de entero, lo que podría permitir a atacantes remotos provocar una denegación de servicio (bucle infinito) a través de una clave pública manipulada a un programa que usa certificados de clientes HTTPS o servidores de librerías SSH. A denial of service vulnerability was found in Go's verification of DSA public keys. An attacker could provide a crafted key to HTTPS client or SSH server libraries which would cause the application to enter an infinite loop. • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182526.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183106.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183137.html http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html http://rhn.redhat.com/errata/RHSA-2016-1538.html http://www.openwall.com/lists/oss-security/2016/04/05/1 http://www.openwall.com/lists/oss-security/2016/04/05/2 https://go-review& • CWE-20: Improper Input Validation CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-8618
https://notcve.org/view.php?id=CVE-2015-8618
The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors. El código Montgomery de Int.Exp en la librería math/big en Go 1.5.x en versiones anteriores a 1.5.3 no maneja correctamente la propagación acarreo y produce una salida incorrecta, lo que facilita a atacantes obtener claves privadas RSA a través de vectores no especificados. • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175642.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176179.html http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html http://www.openwall.com/lists/oss-security/2015/12/21/6 http://www.openwall.com/lists/oss-security/2015/12/22/9 http://www.openwall.com/lists/oss-security/2016/01/13/7 https://github.com/golang/go/issues/13515 https://go-review.googlesource.com/&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2014-7189
https://notcve.org/view.php?id=CVE-2014-7189
crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors. crpyto/tls en Go 1.1 anterior a 1.3.2, cuando SessionTicketsDisabled está habilitado, permite a atacantes man-in-the-middle falsificar clientes através de vectores no especificados. • http://www.openwall.com/lists/oss-security/2014/09/26/28 http://www.securityfocus.com/bid/70156 https://exchange.xforce.ibmcloud.com/vulnerabilities/96693 https://groups.google.com/forum/#%21msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ • CWE-264: Permissions, Privileges, and Access Controls •