Vulnerability-Lookup

OPENSUSE-SU-2024:10806-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 20:05

Summary

go1.13-1.13.15-2.6 on GA media

Severity

Moderate

Notes

Title of the patch: go1.13-1.13.15-2.6 on GA media

Description of the patch: These are all security issues fixed in the go1.13-1.13.15-2.6 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2024-10806

CVE-2019-16276

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2019-17596

6.5 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products, the same list as for CVE-2019-16276

Threats

Impact moderate

CVE-2020-14039

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 12 products, the same list as for CVE-2019-16276

Threats

Impact moderate

CVE-2020-15586

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products, the same list as for CVE-2019-16276

Threats

Impact important

CVE-2020-16845

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2019-16276

Threats

Impact moderate

References

17 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2019-16276/	self
https://www.suse.com/security/cve/CVE-2019-17596/	self
https://www.suse.com/security/cve/CVE-2020-14039/	self
https://www.suse.com/security/cve/CVE-2020-15586/	self
https://www.suse.com/security/cve/CVE-2020-16845/	self
https://www.suse.com/security/cve/CVE-2019-16276	external
https://bugzilla.suse.com/1152082	external
https://www.suse.com/security/cve/CVE-2019-17596	external
https://bugzilla.suse.com/1154402	external
https://www.suse.com/security/cve/CVE-2020-14039	external
https://bugzilla.suse.com/1174191	external
https://www.suse.com/security/cve/CVE-2020-15586	external
https://bugzilla.suse.com/1174153	external
https://www.suse.com/security/cve/CVE-2020-16845	external
https://bugzilla.suse.com/1174977	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "go1.13-1.13.15-2.6 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the go1.13-1.13.15-2.6 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10806",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10806-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-16276 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-16276/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17596 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17596/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-14039 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-14039/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15586 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15586/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-16845 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-16845/"
      }
    ],
    "title": "go1.13-1.13.15-2.6 on GA media",
    "tracking": {
      "current_release_date": "2026-09-20T20:05:55Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10806-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T20:05:55Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.13-0:1.13.15-2.6.aarch64",
                "product": {
                  "name": "go1.13-0:1.13.15-2.6.aarch64",
                  "product_id": "go1.13-0:1.13.15-2.6.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13@1.13.15-2.6?arch=aarch64\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go1.13-doc-0:1.13.15-2.6.aarch64",
                "product": {
                  "name": "go1.13-doc-0:1.13.15-2.6.aarch64",
                  "product_id": "go1.13-doc-0:1.13.15-2.6.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13-doc@1.13.15-2.6?arch=aarch64\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go1.13-race-0:1.13.15-2.6.aarch64",
                "product": {
                  "name": "go1.13-race-0:1.13.15-2.6.aarch64",
                  "product_id": "go1.13-race-0:1.13.15-2.6.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13-race@1.13.15-2.6?arch=aarch64\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.13-0:1.13.15-2.6.ppc64le",
                "product": {
                  "name": "go1.13-0:1.13.15-2.6.ppc64le",
                  "product_id": "go1.13-0:1.13.15-2.6.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13@1.13.15-2.6?arch=ppc64le\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go1.13-doc-0:1.13.15-2.6.ppc64le",
                "product": {
                  "name": "go1.13-doc-0:1.13.15-2.6.ppc64le",
                  "product_id": "go1.13-doc-0:1.13.15-2.6.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13-doc@1.13.15-2.6?arch=ppc64le\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go1.13-race-0:1.13.15-2.6.ppc64le",
                "product": {
                  "name": "go1.13-race-0:1.13.15-2.6.ppc64le",
                  "product_id": "go1.13-race-0:1.13.15-2.6.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13-race@1.13.15-2.6?arch=ppc64le\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.13-0:1.13.15-2.6.s390x",
                "product": {
                  "name": "go1.13-0:1.13.15-2.6.s390x",
                  "product_id": "go1.13-0:1.13.15-2.6.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13@1.13.15-2.6?arch=s390x\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go1.13-doc-0:1.13.15-2.6.s390x",
                "product": {
                  "name": "go1.13-doc-0:1.13.15-2.6.s390x",
                  "product_id": "go1.13-doc-0:1.13.15-2.6.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13-doc@1.13.15-2.6?arch=s390x\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go1.13-race-0:1.13.15-2.6.s390x",
                "product": {
                  "name": "go1.13-race-0:1.13.15-2.6.s390x",
                  "product_id": "go1.13-race-0:1.13.15-2.6.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13-race@1.13.15-2.6?arch=s390x\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.13-0:1.13.15-2.6.x86_64",
                "product": {
                  "name": "go1.13-0:1.13.15-2.6.x86_64",
                  "product_id": "go1.13-0:1.13.15-2.6.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13@1.13.15-2.6?arch=x86_64\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go1.13-doc-0:1.13.15-2.6.x86_64",
                "product": {
                  "name": "go1.13-doc-0:1.13.15-2.6.x86_64",
                  "product_id": "go1.13-doc-0:1.13.15-2.6.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13-doc@1.13.15-2.6?arch=x86_64\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go1.13-race-0:1.13.15-2.6.x86_64",
                "product": {
                  "name": "go1.13-race-0:1.13.15-2.6.x86_64",
                  "product_id": "go1.13-race-0:1.13.15-2.6.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:golang:go:1.13.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/go1.13-race@1.13.15-2.6?arch=x86_64\u0026upstream=go1.13-0:1.13.15-2.6.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-0:1.13.15-2.6.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64"
        },
        "product_reference": "go1.13-0:1.13.15-2.6.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-0:1.13.15-2.6.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le"
        },
        "product_reference": "go1.13-0:1.13.15-2.6.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-0:1.13.15-2.6.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x"
        },
        "product_reference": "go1.13-0:1.13.15-2.6.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-0:1.13.15-2.6.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64"
        },
        "product_reference": "go1.13-0:1.13.15-2.6.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-doc-0:1.13.15-2.6.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64"
        },
        "product_reference": "go1.13-doc-0:1.13.15-2.6.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-doc-0:1.13.15-2.6.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le"
        },
        "product_reference": "go1.13-doc-0:1.13.15-2.6.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-doc-0:1.13.15-2.6.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x"
        },
        "product_reference": "go1.13-doc-0:1.13.15-2.6.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-doc-0:1.13.15-2.6.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64"
        },
        "product_reference": "go1.13-doc-0:1.13.15-2.6.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-race-0:1.13.15-2.6.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64"
        },
        "product_reference": "go1.13-race-0:1.13.15-2.6.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-race-0:1.13.15-2.6.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le"
        },
        "product_reference": "go1.13-race-0:1.13.15-2.6.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-race-0:1.13.15-2.6.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x"
        },
        "product_reference": "go1.13-race-0:1.13.15-2.6.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.13-race-0:1.13.15-2.6.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
        },
        "product_reference": "go1.13-race-0:1.13.15-2.6.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-16276",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-16276"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-16276",
          "url": "https://www.suse.com/security/cve/CVE-2019-16276"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1152082 for CVE-2019-16276",
          "url": "https://bugzilla.suse.com/1152082"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-16276"
    },
    {
      "cve": "CVE-2019-17596",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17596"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17596",
          "url": "https://www.suse.com/security/cve/CVE-2019-17596"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1154402 for CVE-2019-17596",
          "url": "https://bugzilla.suse.com/1154402"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-17596"
    },
    {
      "cve": "CVE-2020-14039",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-14039"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-14039",
          "url": "https://www.suse.com/security/cve/CVE-2020-14039"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1174191 for CVE-2020-14039",
          "url": "https://bugzilla.suse.com/1174191"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-14039"
    },
    {
      "cve": "CVE-2020-15586",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15586"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15586",
          "url": "https://www.suse.com/security/cve/CVE-2020-15586"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1174153 for CVE-2020-15586",
          "url": "https://bugzilla.suse.com/1174153"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-15586"
    },
    {
      "cve": "CVE-2020-16845",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-16845"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
          "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-16845",
          "url": "https://www.suse.com/security/cve/CVE-2020-16845"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1174977 for CVE-2020-16845",
          "url": "https://bugzilla.suse.com/1174977"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-doc-0:1.13.15-2.6.x86_64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.aarch64",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.ppc64le",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.s390x",
            "openSUSE Tumbleweed:go1.13-race-0:1.13.15-2.6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-16845"
    }
  ]
}

CVE-2019-16276 (GCVE-0-2019-16276)

Vulnerability from cvelistv5 – Published: 2019-09-30 18:40 – Updated: 2024-08-05 01:10

Summary

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

13 references

URL	Tags
https://github.com/golang/go/issues/34540	x_refsource_CONFIRM
https://groups.google.com/forum/#%21msg/golang-an…	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://security.netapp.com/advisory/ntap-2019112…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2020:0101	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0329	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0652	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2019-09-25 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:10:41.714Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/golang/go/issues/34540"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ"
          },
          {
            "name": "FEDORA-2019-1b8cbd39ff",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/"
          },
          {
            "name": "FEDORA-2019-416d20f960",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/"
          },
          {
            "name": "FEDORA-2019-e99c1603c3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/"
          },
          {
            "name": "openSUSE-SU-2019:2522",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html"
          },
          {
            "name": "openSUSE-SU-2019:2521",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191122-0004/"
          },
          {
            "name": "RHSA-2020:0101",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0101"
          },
          {
            "name": "RHSA-2020:0329",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0329"
          },
          {
            "name": "RHSA-2020:0652",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0652"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-09-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-13T20:06:30.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/golang/go/issues/34540"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ"
        },
        {
          "name": "FEDORA-2019-1b8cbd39ff",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/"
        },
        {
          "name": "FEDORA-2019-416d20f960",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/"
        },
        {
          "name": "FEDORA-2019-e99c1603c3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/"
        },
        {
          "name": "openSUSE-SU-2019:2522",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html"
        },
        {
          "name": "openSUSE-SU-2019:2521",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20191122-0004/"
        },
        {
          "name": "RHSA-2020:0101",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0101"
        },
        {
          "name": "RHSA-2020:0329",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0329"
        },
        {
          "name": "RHSA-2020:0652",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0652"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-16276",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/golang/go/issues/34540",
              "refsource": "CONFIRM",
              "url": "https://github.com/golang/go/issues/34540"
            },
            {
              "name": "https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ"
            },
            {
              "name": "FEDORA-2019-1b8cbd39ff",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/"
            },
            {
              "name": "FEDORA-2019-416d20f960",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/"
            },
            {
              "name": "FEDORA-2019-e99c1603c3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/"
            },
            {
              "name": "openSUSE-SU-2019:2522",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html"
            },
            {
              "name": "openSUSE-SU-2019:2521",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20191122-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20191122-0004/"
            },
            {
              "name": "RHSA-2020:0101",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0101"
            },
            {
              "name": "RHSA-2020:0329",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0329"
            },
            {
              "name": "RHSA-2020:0652",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0652"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-16276",
    "datePublished": "2019-09-30T18:40:12.000Z",
    "dateReserved": "2019-09-12T00:00:00.000Z",
    "dateUpdated": "2024-08-05T01:10:41.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-17596 (GCVE-0-2019-17596)

Vulnerability from cvelistv5 – Published: 2019-10-24 21:07 – Updated: 2024-08-05 01:47

Summary

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

13 references

URL	Tags
https://groups.google.com/d/msg/golang-announce/l…	x_refsource_CONFIRM
https://github.com/golang/go/issues/34960	x_refsource_CONFIRM
https://www.debian.org/security/2019/dsa-4551	vendor-advisoryx_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://security.netapp.com/advisory/ntap-2019112…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2020:0101	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0329	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://www.arista.com/en/support/advisories-noti…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:47:13.228Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/golang/go/issues/34960"
          },
          {
            "name": "DSA-4551",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4551"
          },
          {
            "name": "FEDORA-2019-4593120208",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/"
          },
          {
            "name": "FEDORA-2019-34e097c66c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/"
          },
          {
            "name": "openSUSE-SU-2019:2522",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html"
          },
          {
            "name": "openSUSE-SU-2019:2521",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191122-0005/"
          },
          {
            "name": "RHSA-2020:0101",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0101"
          },
          {
            "name": "RHSA-2020:0329",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0329"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-08T11:16:34.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/golang/go/issues/34960"
        },
        {
          "name": "DSA-4551",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4551"
        },
        {
          "name": "FEDORA-2019-4593120208",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/"
        },
        {
          "name": "FEDORA-2019-34e097c66c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/"
        },
        {
          "name": "openSUSE-SU-2019:2522",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html"
        },
        {
          "name": "openSUSE-SU-2019:2521",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20191122-0005/"
        },
        {
          "name": "RHSA-2020:0101",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0101"
        },
        {
          "name": "RHSA-2020:0329",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0329"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-17596",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ"
            },
            {
              "name": "https://github.com/golang/go/issues/34960",
              "refsource": "CONFIRM",
              "url": "https://github.com/golang/go/issues/34960"
            },
            {
              "name": "DSA-4551",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4551"
            },
            {
              "name": "FEDORA-2019-4593120208",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/"
            },
            {
              "name": "FEDORA-2019-34e097c66c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/"
            },
            {
              "name": "openSUSE-SU-2019:2522",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html"
            },
            {
              "name": "openSUSE-SU-2019:2521",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20191122-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20191122-0005/"
            },
            {
              "name": "RHSA-2020:0101",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0101"
            },
            {
              "name": "RHSA-2020:0329",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0329"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
            },
            {
              "name": "https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46",
              "refsource": "MISC",
              "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-17596",
    "datePublished": "2019-10-24T21:07:25.000Z",
    "dateReserved": "2019-10-15T00:00:00.000Z",
    "dateUpdated": "2024-08-05T01:47:13.228Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14039 (GCVE-0-2020-14039)

Vulnerability from cvelistv5 – Published: 2020-07-17 15:43 – Updated: 2024-08-04 12:32

Summary

In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

8 references

URL	Tags
https://groups.google.com/forum/#%21forum/golang-…	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://groups.google.com/forum/#%21topic/golang-…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2020073…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21forum/golang-announce"
          },
          {
            "name": "openSUSE-SU-2020:1087",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html"
          },
          {
            "name": "openSUSE-SU-2020:1095",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html"
          },
          {
            "name": "openSUSE-SU-2020:1405",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
          },
          {
            "name": "openSUSE-SU-2020:1407",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200731-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-14T17:20:16.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21forum/golang-announce"
        },
        {
          "name": "openSUSE-SU-2020:1087",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html"
        },
        {
          "name": "openSUSE-SU-2020:1095",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html"
        },
        {
          "name": "openSUSE-SU-2020:1405",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
        },
        {
          "name": "openSUSE-SU-2020:1407",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200731-0005/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-14039",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!forum/golang-announce",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!forum/golang-announce"
            },
            {
              "name": "openSUSE-SU-2020:1087",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html"
            },
            {
              "name": "openSUSE-SU-2020:1095",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html"
            },
            {
              "name": "openSUSE-SU-2020:1405",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
            },
            {
              "name": "openSUSE-SU-2020:1407",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/golang-announce/XZNfaiwgt2w",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!topic/golang-announce/XZNfaiwgt2w"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200731-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200731-0005/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-14039",
    "datePublished": "2020-07-17T15:43:33.000Z",
    "dateReserved": "2020-06-12T00:00:00.000Z",
    "dateUpdated": "2024-08-04T12:32:14.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-15586 (GCVE-0-2020-15586)

Vulnerability from cvelistv5 – Published: 2020-07-17 15:38 – Updated: 2024-08-04 13:22

Summary

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

14 references

URL	Tags
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2021/dsa-4848	vendor-advisoryx_refsource_DEBIAN
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://groups.google.com/forum/#%21topic/golang-…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2020073…	x_refsource_CONFIRM
https://groups.google.com/forum/#%21topic/golang-…	x_refsource_MISC
https://www.cloudfoundry.org/blog/cve-2020-15586/	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:22:29.273Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2020:1087",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html"
          },
          {
            "name": "openSUSE-SU-2020:1095",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html"
          },
          {
            "name": "FEDORA-2020-d75360e2b0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCR6LAKCVKL55KJQPPBBWVQGOP7RL2RW/"
          },
          {
            "name": "FEDORA-2020-9cd1204ba0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WIRVUHD7TJIT7JJ33FKHIVTHPYABYPHR/"
          },
          {
            "name": "openSUSE-SU-2020:1405",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
          },
          {
            "name": "openSUSE-SU-2020:1407",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
          },
          {
            "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html"
          },
          {
            "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html"
          },
          {
            "name": "DSA-4848",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4848"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200731-0005/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/golang-announce/f2c5bqrGH_g"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.cloudfoundry.org/blog/cve-2020-15586/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-14T17:20:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "openSUSE-SU-2020:1087",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html"
        },
        {
          "name": "openSUSE-SU-2020:1095",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html"
        },
        {
          "name": "FEDORA-2020-d75360e2b0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCR6LAKCVKL55KJQPPBBWVQGOP7RL2RW/"
        },
        {
          "name": "FEDORA-2020-9cd1204ba0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WIRVUHD7TJIT7JJ33FKHIVTHPYABYPHR/"
        },
        {
          "name": "openSUSE-SU-2020:1405",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
        },
        {
          "name": "openSUSE-SU-2020:1407",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
        },
        {
          "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html"
        },
        {
          "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html"
        },
        {
          "name": "DSA-4848",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4848"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200731-0005/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21topic/golang-announce/f2c5bqrGH_g"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.cloudfoundry.org/blog/cve-2020-15586/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-15586",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2020:1087",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html"
            },
            {
              "name": "openSUSE-SU-2020:1095",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html"
            },
            {
              "name": "FEDORA-2020-d75360e2b0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCR6LAKCVKL55KJQPPBBWVQGOP7RL2RW/"
            },
            {
              "name": "FEDORA-2020-9cd1204ba0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIRVUHD7TJIT7JJ33FKHIVTHPYABYPHR/"
            },
            {
              "name": "openSUSE-SU-2020:1405",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
            },
            {
              "name": "openSUSE-SU-2020:1407",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
            },
            {
              "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html"
            },
            {
              "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html"
            },
            {
              "name": "DSA-4848",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4848"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/golang-announce/XZNfaiwgt2w",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!topic/golang-announce/XZNfaiwgt2w"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200731-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200731-0005/"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/golang-announce/f2c5bqrGH_g",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!topic/golang-announce/f2c5bqrGH_g"
            },
            {
              "name": "https://www.cloudfoundry.org/blog/cve-2020-15586/",
              "refsource": "CONFIRM",
              "url": "https://www.cloudfoundry.org/blog/cve-2020-15586/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-15586",
    "datePublished": "2020-07-17T15:38:24.000Z",
    "dateReserved": "2020-07-07T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:22:29.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-16845 (GCVE-0-2020-16845)

Vulnerability from cvelistv5 – Published: 2020-08-06 17:03 – Updated: 2024-08-04 13:45

Summary

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

15 references

URL	Tags
https://groups.google.com/forum/#%21topic/golang-…	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2021/dsa-4848	vendor-advisoryx_refsource_DEBIAN
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://groups.google.com/forum/#%21topic/golang-…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2020092…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:45:33.920Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q"
          },
          {
            "name": "openSUSE-SU-2020:1178",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html"
          },
          {
            "name": "openSUSE-SU-2020:1194",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html"
          },
          {
            "name": "FEDORA-2020-e384830a0d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/"
          },
          {
            "name": "FEDORA-2020-deff052e7a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/"
          },
          {
            "name": "FEDORA-2020-a55f130272",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/"
          },
          {
            "name": "FEDORA-2020-b190375a37",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/"
          },
          {
            "name": "openSUSE-SU-2020:1405",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
          },
          {
            "name": "openSUSE-SU-2020:1407",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
          },
          {
            "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html"
          },
          {
            "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html"
          },
          {
            "name": "DSA-4848",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4848"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200924-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-14T17:20:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q"
        },
        {
          "name": "openSUSE-SU-2020:1178",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html"
        },
        {
          "name": "openSUSE-SU-2020:1194",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html"
        },
        {
          "name": "FEDORA-2020-e384830a0d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/"
        },
        {
          "name": "FEDORA-2020-deff052e7a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/"
        },
        {
          "name": "FEDORA-2020-a55f130272",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/"
        },
        {
          "name": "FEDORA-2020-b190375a37",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/"
        },
        {
          "name": "openSUSE-SU-2020:1405",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
        },
        {
          "name": "openSUSE-SU-2020:1407",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
        },
        {
          "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html"
        },
        {
          "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html"
        },
        {
          "name": "DSA-4848",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4848"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200924-0002/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-16845",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q"
            },
            {
              "name": "openSUSE-SU-2020:1178",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html"
            },
            {
              "name": "openSUSE-SU-2020:1194",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html"
            },
            {
              "name": "FEDORA-2020-e384830a0d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/"
            },
            {
              "name": "FEDORA-2020-deff052e7a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/"
            },
            {
              "name": "FEDORA-2020-a55f130272",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/"
            },
            {
              "name": "FEDORA-2020-b190375a37",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/"
            },
            {
              "name": "openSUSE-SU-2020:1405",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html"
            },
            {
              "name": "openSUSE-SU-2020:1407",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html"
            },
            {
              "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html"
            },
            {
              "name": "[debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html"
            },
            {
              "name": "DSA-4848",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4848"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200924-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200924-0002/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-16845",
    "datePublished": "2020-08-06T17:03:33.000Z",
    "dateReserved": "2020-08-04T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:45:33.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2024:10806-1

CVE-2019-16276 (GCVE-0-2019-16276)

CVE-2019-17596 (GCVE-0-2019-17596)

CVE-2020-14039 (GCVE-0-2020-14039)

CVE-2020-15586 (GCVE-0-2020-15586)

CVE-2020-16845 (GCVE-0-2020-16845)

Tags

Sightings

Nomenclature

Related by attack behaviour