Search CVE reports
81 – 90 of 96 results
Some fixes available 8 of 12
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
7 affected packages
golang-golang-x-net, containerd, golang-golang-x-net-dev, adsys, google-guest-agent...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| google-guest-agent | Not affected | Not affected | Not affected | Not affected | Not affected |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
Some fixes available 23 of 39
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
20 affected packages
golang-golang-x-net, containerd, golang-1.13, adsys, golang...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| golang-1.13 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| golang | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.10 | Not in release | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.14 | Not in release | Not in release | Not in release | Vulnerable | Not in release |
| golang-1.16 | Not in release | Not in release | Not in release | Vulnerable | Vulnerable |
| golang-1.17 | Not in release | Not in release | Fixed | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.19 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.20 | Not in release | Not in release | Not affected | Not affected | Not in release |
| golang-1.21 | Not in release | Not affected | Not affected | Not affected | Not in release |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.9 | Not in release | Not in release | Not in release | Not in release | Vulnerable |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| google-guest-agent | Fixed | Fixed | Fixed | Fixed | Fixed |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
Some fixes available 26 of 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
17 affected packages
golang-1.13, golang-1.14, golang-1.16, golang-1.17, golang-1.18...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.13 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.14 | — | — | Not in release | Vulnerable | Not in release |
| golang-1.16 | — | — | Not in release | Fixed | Fixed |
| golang-1.17 | — | — | Vulnerable | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.8 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.9 | — | — | Not in release | Not in release | Vulnerable |
| google-guest-agent | Fixed | Fixed | Fixed | Fixed | Needs evaluation |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| golang | — | — | Not in release | Not in release | Not in release |
| golang-1.10 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.6 | — | — | Not in release | Not in release | Not in release |
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
3 affected packages
golang-go.crypto, lxd, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| lxd | — | — | — | Not affected | Not affected |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
3 affected packages
golang-go.crypto, lxd, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| lxd | — | — | Not in release | Not affected | Not affected |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
3 affected packages
golang-go.crypto, lxd, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| lxd | — | — | — | Not affected | Needs evaluation |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |
Some fixes available 2 of 10
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
4 affected packages
golang-golang-x-net, golang-golang-x-net-dev, google-guest-agent, lxd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | — | Not affected | Not affected | Not in release | Not in release |
| golang-golang-x-net-dev | — | Not in release | Not in release | Fixed | Not affected |
| google-guest-agent | — | Not affected | Not affected | Not affected | Not affected |
| lxd | — | Not in release | Not in release | Not affected | Fixed |
Some fixes available 11 of 20
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
4 affected packages
golang-go.crypto, kubernetes, lxd, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Fixed | Fixed | Fixed | Vulnerable | Not affected |
| kubernetes | Not in release | Not affected | Not affected | Not affected | Not in release |
| lxd | — | — | — | Not affected | Not affected |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server...
4 affected packages
golang-go.crypto, lxd, mongo-tools, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Not affected | Not affected | Not affected | Not affected | Vulnerable |
| lxd | — | — | — | Not affected | Not affected |
| mongo-tools | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |
An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20...
3 affected packages
golang-go.crypto, lxd, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Not affected | Not affected | Not affected | Not affected | Vulnerable |
| lxd | — | — | — | Not affected | Not affected |
| snapd | Ignored | Ignored | Ignored | Ignored | Ignored |