Your submission was sent successfully! Close

Thank you for contacting us. A member of our team will be in touch shortly. Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

Search CVE reports


Toggle filters

31 – 40 of 62 results


CVE-2023-24537

Medium priority

Some fixes available 11 of 14

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

11 affected packages

golang-1.10, golang-1.13, golang-1.14, golang-1.16, golang-1.17...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.10 Not in release Not in release Not in release Not affected Not affected
golang-1.13 Not in release Fixed Fixed Fixed Fixed
golang-1.14 Not in release Not in release Vulnerable Not in release Ignored
golang-1.16 Not in release Not in release Fixed Fixed Ignored
golang-1.17 Not in release Vulnerable Not in release Not in release Ignored
golang-1.18 Not in release Fixed Fixed Fixed Fixed
golang-1.19 Not in release Not in release Not in release Not in release Ignored
golang-1.20 Not in release Not affected Not affected Not in release Ignored
golang-1.6 Not in release Not in release Not in release Not in release Not affected
golang-1.8 Not in release Not in release Not in release Not affected Ignored
golang-1.9 Not in release Not in release Not in release Not affected Ignored
Show all 11 packages Show less packages

CVE-2023-24536

Medium priority
Vulnerable

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a...

11 affected packages

golang-1.10, golang-1.13, golang-1.14, golang-1.16, golang-1.17...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.10 Not in release Not in release Not in release Vulnerable Vulnerable
golang-1.13 Not in release Vulnerable Vulnerable Vulnerable Vulnerable
golang-1.14 Not in release Not in release Vulnerable Not in release Ignored
golang-1.16 Not in release Not in release Vulnerable Vulnerable Ignored
golang-1.17 Not in release Vulnerable Not in release Not in release Ignored
golang-1.18 Not in release Vulnerable Vulnerable Vulnerable Vulnerable
golang-1.19 Not in release Not in release Not in release Not in release Ignored
golang-1.20 Not in release Not affected Not affected Not in release Ignored
golang-1.6 Not in release Not in release Not in release Not in release Vulnerable
golang-1.8 Not in release Not in release Not in release Vulnerable Ignored
golang-1.9 Not in release Not in release Not in release Vulnerable Ignored
Show all 11 packages Show less packages

CVE-2023-24534

Medium priority

Some fixes available 11 of 20

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP...

11 affected packages

golang-1.10, golang-1.13, golang-1.14, golang-1.16, golang-1.17...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang-1.10 Not in release Not in release Not in release Vulnerable Vulnerable
golang-1.13 Not in release Fixed Fixed Fixed Fixed
golang-1.14 Not in release Not in release Vulnerable Not in release Ignored
golang-1.16 Not in release Not in release Fixed Fixed Ignored
golang-1.17 Not in release Vulnerable Not in release Not in release Ignored
golang-1.18 Not in release Fixed Fixed Fixed Fixed
golang-1.19 Not in release Not in release Not in release Not in release Ignored
golang-1.20 Not in release Not affected Not affected Not in release Ignored
golang-1.6 Not in release Not in release Not in release Not in release Vulnerable
golang-1.8 Not in release Not in release Not in release Vulnerable Ignored
golang-1.9 Not in release Not in release Not in release Vulnerable Ignored
Show all 11 packages Show less packages

CVE-2023-24532

Medium priority
Needs evaluation

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa...

10 affected packages

golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang Not in release Not in release Not in release Ignored
golang-1.10 Not in release Not in release Needs evaluation Needs evaluation
golang-1.13 Needs evaluation Needs evaluation Needs evaluation Needs evaluation
golang-1.14 Not in release Needs evaluation Not in release Not in release
golang-1.16 Not in release Needs evaluation Needs evaluation Ignored
golang-1.17 Needs evaluation Not in release Not in release Ignored
golang-1.18 Needs evaluation Needs evaluation Needs evaluation Needs evaluation
golang-1.6 Not in release Not in release Not in release Needs evaluation
golang-1.8 Not in release Not in release Needs evaluation Not in release
golang-1.9 Not in release Not in release Needs evaluation Not in release
Show all 10 packages Show less packages

CVE-2022-41725

Medium priority

Some fixes available 1 of 19

A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This...

14 affected packages

containerd, golang, golang-1.10, golang-1.13, golang-1.14...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
containerd Not affected Not affected Not affected Not affected Not affected
golang Not in release Not in release Not in release Not in release Not in release
golang-1.10 Not in release Not in release Not in release Vulnerable Vulnerable
golang-1.13 Not in release Vulnerable Vulnerable Vulnerable Vulnerable
golang-1.14 Not in release Not in release Vulnerable Not in release Not in release
golang-1.16 Not in release Not in release Vulnerable Vulnerable Not in release
golang-1.17 Not in release Vulnerable Not in release Not in release Not in release
golang-1.18 Not in release Vulnerable Vulnerable Vulnerable Vulnerable
golang-1.19 Not in release Not in release Not in release Not in release Ignored
golang-1.20 Not in release Not affected Not affected Not in release Ignored
golang-1.21 Not affected Not affected Not affected Not in release Not in release
golang-1.6 Not in release Not in release Not in release Not in release Vulnerable
golang-1.8 Not in release Not in release Not in release Vulnerable Not in release
golang-1.9 Not in release Not in release Not in release Vulnerable Not in release
Show all 14 packages Show less packages

CVE-2022-41724

Medium priority

Some fixes available 1 of 13

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all...

13 affected packages

golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang Not in release Not in release Not in release Not in release Not in release
golang-1.10 Not in release Not in release Not in release Not affected Not affected
golang-1.13 Not in release Vulnerable Vulnerable Vulnerable Vulnerable
golang-1.14 Not in release Not in release Vulnerable Not in release Not in release
golang-1.16 Not in release Not in release Vulnerable Vulnerable Not in release
golang-1.17 Not in release Vulnerable Not in release Not in release Not in release
golang-1.18 Not in release Needs evaluation Needs evaluation Vulnerable Vulnerable
golang-1.19 Not in release Not in release Not in release Not in release Ignored
golang-1.20 Not in release Not affected Not affected Not in release Ignored
golang-1.21 Not affected Not affected Not affected Not in release Not in release
golang-1.6 Not in release Not in release Not in release Not in release Not affected
golang-1.8 Not in release Not in release Not in release Not affected Not in release
golang-1.9 Not in release Not in release Not in release Not affected Not in release
Show all 13 packages Show less packages

CVE-2022-41723

Medium priority

Some fixes available 5 of 29

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

16 affected packages

containerd, golang, golang-1.10, golang-1.13, golang-1.14...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
containerd Not affected Not affected Not affected Not affected Not affected
golang Not in release Not in release Not in release Not in release Not in release
golang-1.10 Not in release Not in release Not in release Vulnerable Vulnerable
golang-1.13 Not in release Vulnerable Vulnerable Vulnerable Vulnerable
golang-1.14 Not in release Not in release Vulnerable Not in release Not in release
golang-1.16 Not in release Not in release Vulnerable Vulnerable Not in release
golang-1.17 Not in release Vulnerable Not in release Not in release Not in release
golang-1.18 Not in release Vulnerable Vulnerable Vulnerable Vulnerable
golang-1.19 Not in release Not in release Not in release Not in release Not in release
golang-1.20 Not in release Not affected Not affected Not in release Not in release
golang-1.21 Not affected Not affected Not affected Not in release Not in release
golang-1.6 Not in release Not in release Not in release Not in release Vulnerable
golang-1.8 Not in release Not in release Not in release Vulnerable Not in release
golang-1.9 Not in release Not in release Not in release Vulnerable Not in release
golang-golang-x-net Not affected Vulnerable Not in release Not in release Ignored
google-guest-agent Fixed Fixed Fixed Vulnerable Vulnerable
Show all 16 packages Show less packages

CVE-2022-41717

Medium priority

Some fixes available 10 of 19

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped,...

10 affected packages

golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang Not in release Not in release Not in release Ignored
golang-1.10 Not in release Not in release Vulnerable Needs evaluation
golang-1.13 Not in release Fixed Fixed Fixed Fixed
golang-1.14 Not in release Vulnerable Not in release Not in release
golang-1.16 Not in release Fixed Fixed Ignored
golang-1.17 Vulnerable Not in release Not in release Ignored
golang-1.18 Not in release Fixed Fixed Fixed Fixed
golang-1.6 Not in release Not in release Not in release Needs evaluation
golang-1.8 Not in release Not in release Vulnerable Not in release
golang-1.9 Not in release Not in release Vulnerable Not in release
Show all 10 packages Show less packages

CVE-2022-41720

Medium priority
Not affected

On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files...

10 affected packages

golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang Not in release Not in release Not in release Ignored
golang-1.10 Not in release Not in release Not affected Not affected
golang-1.13 Not affected Not affected Not affected Not affected
golang-1.14 Not in release Not affected Not in release Not in release
golang-1.16 Not in release Not affected Not affected Ignored
golang-1.17 Not affected Not in release Not in release Ignored
golang-1.18 Not affected Not affected Not affected Ignored
golang-1.6 Not in release Not in release Not in release Not affected
golang-1.8 Not in release Not in release Not affected Not in release
golang-1.9 Not in release Not in release Not affected Not in release
Show all 10 packages Show less packages

CVE-2022-41716

Negligible priority
Needs evaluation

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked...

12 affected packages

golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
golang Not in release Not in release Not in release Not in release Ignored
golang-1.10 Not in release Not in release Not in release Needs evaluation Needs evaluation
golang-1.13 Not in release Needs evaluation Needs evaluation Needs evaluation Needs evaluation
golang-1.14 Not in release Not in release Needs evaluation Not in release Not in release
golang-1.16 Not in release Not in release Needs evaluation Needs evaluation Ignored
golang-1.17 Not in release Needs evaluation Not in release Not in release Ignored
golang-1.18 Not in release Needs evaluation Needs evaluation Needs evaluation Needs evaluation
golang-1.19 Not in release Not in release Not in release Not in release Ignored
golang-1.20 Not in release Needs evaluation Needs evaluation Not in release Ignored
golang-1.6 Not in release Not in release Not in release Not in release Needs evaluation
golang-1.8 Not in release Not in release Not in release Needs evaluation Not in release
golang-1.9 Not in release Not in release Not in release Needs evaluation Not in release
Show all 12 packages Show less packages