Golang Go any version

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

Insufficient sanitization of Host header in net/http

Improper sanitization of Transfer-Encoding headers in net/http

Exposure of client IP addresses in net/http

Excessive CPU consumption when building archive index in archive/zip

Unexpected paths returned from LookPath in os/exec

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Improper handling of HTML-like comments in script contexts in html/template

Improper handling of special tags within script contexts in html/template

Escaper bypass leads to XSS in html/template

URLs in meta content attribute actions are not escaped in html/template

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Bypass of meta content URL escaping causes XSS in html/template

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.

Invoking "go tool pack" does not sanitize output paths in cmd/go

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.

Stack exhaustion due to deeply nested types in go/parser

Mishandling of corrupt central directory record in archive/zip

Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall

Unbounded allocation for old GNU sparse in archive/tar

Excessive memory growth in net/http and golang.org/x/net/http2

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.

Large RSA keys can cause high CPU usage in crypto/tls

Denial of service via chunk extensions in net/http

Incorrect detection of reserved device names on Windows in path/filepath

Incorrect calculation on P256 curves in crypto/internal/nistec

Excessive CPU consumption in Reader.ReadResponse in net/textproto

Parsing DER payload can cause memory exhaustion in encoding/asn1

ALPN negotiation error contains attacker controlled information in crypto/tls

Insufficient validation of bracketed IPv6 hostnames in net/url

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil