TI-2023-24278 CVE-2023-45288 · GHSA-4v7x-pqxf-cx7m
HTTP/2 CONTINUATION flood in net/http
Priority HIGH 81
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
RHSA-2024:8425
OpenShift Container Platform 4.15.37 bug fix and security update
Released 2024-10-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
Fixes 9 records
TI-2023-27070 CVE-2023-49569 · GHSA-449p-3h89-pw88
Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
Priority MEDIUM 52
A path traversal vulnerability was discovered in go-git versions prior to v5.11.
TI-2024-16308 CVE-2024-24791 · GHSA-hw49-2p59-3mhj
Denial of service due to improper 100-continue handling in net/http
Priority MEDIUM 42
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status.
TI-2024-22607 CVE-2024-34158 · GHSA-j7vj-rw65-4v26
Stack exhaustion in Parse in go/build/constraint
Priority MEDIUM 41
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
TI-2024-22606 CVE-2024-34156 · GHSA-crqm-pwhx-j97f
Stack exhaustion in Decoder.Decode in encoding/gob
Priority MEDIUM 41
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
TI-2024-18690 CVE-2024-28110 · GHSA-5pf6-2qwx-pxm2
Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials
Priority MEDIUM 40
Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents.
TI-2024-03473 CVE-2024-3727 · GHSA-6wvf-f2vw-3425
Containers/image: digest type does not guarantee valid type
Priority LOW 39
A flaw was found in the github.com/containers/image library.
TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Priority LOW 26
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.
TI-2024-22605 CVE-2024-34155 · GHSA-8xfx-rj4p-23jm
Stack exhaustion in all Parse functions in go/parser
Priority LOW 22
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.