TI-2023-24278 CVE-2023-45288 · GHSA-4v7x-pqxf-cx7m
HTTP/2 CONTINUATION flood in net/http
Priority HIGH 81
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
RHSA-2025:0536
cert-manager Operator for Red Hat OpenShift 1.15.0
Released 2025-01-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- cert-manager operator for Red Hat OpenShift 1.15 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
Fixes 7 records
TI-2024-30407 CVE-2024-45337 · GHSA-v778-237x-gjrc
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Priority MEDIUM 53
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.
TI-2024-30408 CVE-2024-45338 · GHSA-w32m-9786-jp63
Non-linear parsing of case-insensitive content in golang.org/x/net/html
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
TI-2024-23322 CVE-2024-35255 · GHSA-m5vv-6r4h-3vj9
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Priority LOW 28
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
TI-2024-16300 CVE-2024-24783 · GHSA-3q2c-pvp5-3cqp
Verify panics on certificates with an unknown public key algorithm in crypto/x509
Priority LOW 28
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.
TI-2024-05657 CVE-2024-6104 · GHSA-v6v8-xj6m-xwqh
go-retryablehttp can leak basic auth credentials to log files
Priority LOW 27
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file.
TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Priority LOW 26
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.