csaf_opensuse - opensuse-su-2024:10811-1

opensuse-su-2024:10811-1

Vulnerability from csaf_opensuse

Published

2024-06-15 00:00

Modified

2024-06-15 00:00

Summary

go1.4-1.4.3-12.2 on GA media

Notes

Title of the patch

go1.4-1.4.3-12.2 on GA media

Description of the patch

These are all security issues fixed in the go1.4-1.4.3-12.2 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-10811

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "go1.4-1.4.3-12.2 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the go1.4-1.4.3-12.2 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10811",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10811-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-7189 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-7189/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-5386 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-5386/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-15041 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-15041/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-15042 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-15042/"
      }
    ],
    "title": "go1.4-1.4.3-12.2 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10811-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.4-1.4.3-12.2.aarch64",
                "product": {
                  "name": "go1.4-1.4.3-12.2.aarch64",
                  "product_id": "go1.4-1.4.3-12.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.4-doc-1.4.3-12.2.aarch64",
                "product": {
                  "name": "go1.4-doc-1.4.3-12.2.aarch64",
                  "product_id": "go1.4-doc-1.4.3-12.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.4-race-1.4.3-12.2.aarch64",
                "product": {
                  "name": "go1.4-race-1.4.3-12.2.aarch64",
                  "product_id": "go1.4-race-1.4.3-12.2.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.4-1.4.3-12.2.ppc64le",
                "product": {
                  "name": "go1.4-1.4.3-12.2.ppc64le",
                  "product_id": "go1.4-1.4.3-12.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.4-doc-1.4.3-12.2.ppc64le",
                "product": {
                  "name": "go1.4-doc-1.4.3-12.2.ppc64le",
                  "product_id": "go1.4-doc-1.4.3-12.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.4-race-1.4.3-12.2.ppc64le",
                "product": {
                  "name": "go1.4-race-1.4.3-12.2.ppc64le",
                  "product_id": "go1.4-race-1.4.3-12.2.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.4-1.4.3-12.2.s390x",
                "product": {
                  "name": "go1.4-1.4.3-12.2.s390x",
                  "product_id": "go1.4-1.4.3-12.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.4-doc-1.4.3-12.2.s390x",
                "product": {
                  "name": "go1.4-doc-1.4.3-12.2.s390x",
                  "product_id": "go1.4-doc-1.4.3-12.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.4-race-1.4.3-12.2.s390x",
                "product": {
                  "name": "go1.4-race-1.4.3-12.2.s390x",
                  "product_id": "go1.4-race-1.4.3-12.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.4-1.4.3-12.2.x86_64",
                "product": {
                  "name": "go1.4-1.4.3-12.2.x86_64",
                  "product_id": "go1.4-1.4.3-12.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.4-doc-1.4.3-12.2.x86_64",
                "product": {
                  "name": "go1.4-doc-1.4.3-12.2.x86_64",
                  "product_id": "go1.4-doc-1.4.3-12.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.4-race-1.4.3-12.2.x86_64",
                "product": {
                  "name": "go1.4-race-1.4.3-12.2.x86_64",
                  "product_id": "go1.4-race-1.4.3-12.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-1.4.3-12.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64"
        },
        "product_reference": "go1.4-1.4.3-12.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-1.4.3-12.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le"
        },
        "product_reference": "go1.4-1.4.3-12.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-1.4.3-12.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x"
        },
        "product_reference": "go1.4-1.4.3-12.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-1.4.3-12.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64"
        },
        "product_reference": "go1.4-1.4.3-12.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-doc-1.4.3-12.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64"
        },
        "product_reference": "go1.4-doc-1.4.3-12.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-doc-1.4.3-12.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le"
        },
        "product_reference": "go1.4-doc-1.4.3-12.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-doc-1.4.3-12.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x"
        },
        "product_reference": "go1.4-doc-1.4.3-12.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-doc-1.4.3-12.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64"
        },
        "product_reference": "go1.4-doc-1.4.3-12.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-race-1.4.3-12.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64"
        },
        "product_reference": "go1.4-race-1.4.3-12.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-race-1.4.3-12.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le"
        },
        "product_reference": "go1.4-race-1.4.3-12.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-race-1.4.3-12.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x"
        },
        "product_reference": "go1.4-race-1.4.3-12.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.4-race-1.4.3-12.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
        },
        "product_reference": "go1.4-race-1.4.3-12.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-7189",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-7189"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-7189",
          "url": "https://www.suse.com/security/cve/CVE-2014-7189"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 898901 for CVE-2014-7189",
          "url": "https://bugzilla.suse.com/898901"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-7189"
    },
    {
      "cve": "CVE-2016-5386",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-5386"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application\u0027s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-5386",
          "url": "https://www.suse.com/security/cve/CVE-2016-5386"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988484 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/988484"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988486 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/988486"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988487 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/988487"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988488 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/988488"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988489 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/988489"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988491 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/988491"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988492 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/988492"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 989125 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/989125"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 989174 for CVE-2016-5386",
          "url": "https://bugzilla.suse.com/989174"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-5386"
    },
    {
      "cve": "CVE-2017-15041",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-15041"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository\u0027s Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-15041",
          "url": "https://www.suse.com/security/cve/CVE-2017-15041"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1062085 for CVE-2017-15041",
          "url": "https://bugzilla.suse.com/1062085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2017-15041"
    },
    {
      "cve": "CVE-2017-15042",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-15042"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn\u0027t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
          "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-15042",
          "url": "https://www.suse.com/security/cve/CVE-2017-15042"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1062087 for CVE-2017-15042",
          "url": "https://bugzilla.suse.com/1062087"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-doc-1.4.3-12.2.x86_64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.aarch64",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.ppc64le",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.s390x",
            "openSUSE Tumbleweed:go1.4-race-1.4.3-12.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2017-15042"
    }
  ]
}

CVE-2017-15042 (GCVE-0-2017-15042)

Vulnerability from cvelistv5

Published

2017-10-05 21:00

Modified

2024-08-05 19:42

Severity ?

CWE

Summary

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2017:3463	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:0878	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/101197	vdb-entry, x_refsource_BID
	https://golang.org/cl/68210	x_refsource_CONFIRM
	https://golang.org/cl/68023	x_refsource_CONFIRM
	https://github.com/golang/go/issues/22134	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201710-23	vendor-advisory, x_refsource_GENTOO
	https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:42:22.302Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:3463",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3463"
          },
          {
            "name": "RHSA-2018:0878",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0878"
          },
          {
            "name": "101197",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101197"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://golang.org/cl/68210"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://golang.org/cl/68023"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/golang/go/issues/22134"
          },
          {
            "name": "GLSA-201710-23",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201710-23"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-10-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn\u0027t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-04-11T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2017:3463",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3463"
        },
        {
          "name": "RHSA-2018:0878",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0878"
        },
        {
          "name": "101197",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101197"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://golang.org/cl/68210"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://golang.org/cl/68023"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/golang/go/issues/22134"
        },
        {
          "name": "GLSA-201710-23",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201710-23"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-15042",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn\u0027t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:3463",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3463"
            },
            {
              "name": "RHSA-2018:0878",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0878"
            },
            {
              "name": "101197",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101197"
            },
            {
              "name": "https://golang.org/cl/68210",
              "refsource": "CONFIRM",
              "url": "https://golang.org/cl/68210"
            },
            {
              "name": "https://golang.org/cl/68023",
              "refsource": "CONFIRM",
              "url": "https://golang.org/cl/68023"
            },
            {
              "name": "https://github.com/golang/go/issues/22134",
              "refsource": "CONFIRM",
              "url": "https://github.com/golang/go/issues/22134"
            },
            {
              "name": "GLSA-201710-23",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201710-23"
            },
            {
              "name": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-15042",
    "datePublished": "2017-10-05T21:00:00",
    "dateReserved": "2017-10-05T00:00:00",
    "dateUpdated": "2024-08-05T19:42:22.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-5386 (GCVE-0-2016-5386)

Vulnerability from cvelistv5

Published

2016-07-19 01:00

Modified

2024-08-06 01:00

Severity ?

CWE

Summary

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

References

►

URL

Tags

	http://www.kb.cert.org/vuls/id/797896	third-party-advisory, x_refsource_CERT-VN
	https://bugzilla.redhat.com/show_bug.cgi?id=1353798	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJPEWB5ZNTU/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZVJ3WEESJ/	vendor-advisory, x_refsource_FEDORA
	http://rhn.redhat.com/errata/RHSA-2016-1538.html	vendor-advisory, x_refsource_REDHAT
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us	x_refsource_CONFIRM
	https://httpoxy.org/	x_refsource_MISC
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:00:59.948Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VU#797896",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/797896"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353798"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "name": "FEDORA-2016-340e361b90",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJPEWB5ZNTU/"
          },
          {
            "name": "FEDORA-2016-ea5e284d34",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZVJ3WEESJ/"
          },
          {
            "name": "RHSA-2016:1538",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1538.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://httpoxy.org/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-07-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application\u0027s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-24T09:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "VU#797896",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/797896"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353798"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "name": "FEDORA-2016-340e361b90",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJPEWB5ZNTU/"
        },
        {
          "name": "FEDORA-2016-ea5e284d34",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZVJ3WEESJ/"
        },
        {
          "name": "RHSA-2016:1538",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1538.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://httpoxy.org/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2016-5386",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application\u0027s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "VU#797896",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/797896"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1353798",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353798"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "FEDORA-2016-340e361b90",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJPEWB5ZNTU/"
            },
            {
              "name": "FEDORA-2016-ea5e284d34",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZVJ3WEESJ/"
            },
            {
              "name": "RHSA-2016:1538",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1538.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us"
            },
            {
              "name": "https://httpoxy.org/",
              "refsource": "MISC",
              "url": "https://httpoxy.org/"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-5386",
    "datePublished": "2016-07-19T01:00:00",
    "dateReserved": "2016-06-10T00:00:00",
    "dateUpdated": "2024-08-06T01:00:59.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-15041 (GCVE-0-2017-15041)

Vulnerability from cvelistv5

Published

2017-10-05 21:00

Modified

2024-08-05 19:42

Severity ?

CWE

Summary

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2017:3463	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:0878	vendor-advisory, x_refsource_REDHAT
	https://golang.org/cl/68190	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/101196	vdb-entry, x_refsource_BID
	https://golang.org/cl/68022	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201710-23	vendor-advisory, x_refsource_GENTOO
	https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ	x_refsource_CONFIRM
	https://github.com/golang/go/issues/22125	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:42:22.368Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:3463",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3463"
          },
          {
            "name": "RHSA-2018:0878",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0878"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://golang.org/cl/68190"
          },
          {
            "name": "101196",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://golang.org/cl/68022"
          },
          {
            "name": "GLSA-201710-23",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201710-23"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/golang/go/issues/22125"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-10-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository\u0027s Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-13T20:06:28",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2017:3463",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3463"
        },
        {
          "name": "RHSA-2018:0878",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0878"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://golang.org/cl/68190"
        },
        {
          "name": "101196",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://golang.org/cl/68022"
        },
        {
          "name": "GLSA-201710-23",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201710-23"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/golang/go/issues/22125"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-15041",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository\u0027s Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:3463",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3463"
            },
            {
              "name": "RHSA-2018:0878",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0878"
            },
            {
              "name": "https://golang.org/cl/68190",
              "refsource": "CONFIRM",
              "url": "https://golang.org/cl/68190"
            },
            {
              "name": "101196",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101196"
            },
            {
              "name": "https://golang.org/cl/68022",
              "refsource": "CONFIRM",
              "url": "https://golang.org/cl/68022"
            },
            {
              "name": "GLSA-201710-23",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201710-23"
            },
            {
              "name": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ"
            },
            {
              "name": "https://github.com/golang/go/issues/22125",
              "refsource": "CONFIRM",
              "url": "https://github.com/golang/go/issues/22125"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-15041",
    "datePublished": "2017-10-05T21:00:00",
    "dateReserved": "2017-10-05T00:00:00",
    "dateUpdated": "2024-08-05T19:42:22.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-7189 (GCVE-0-2014-7189)

Vulnerability from cvelistv5

Published

2014-10-07 14:00

Modified

2024-08-06 12:40

Severity ?

CWE

Summary

crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors.

References

►

URL

Tags

	https://exchange.xforce.ibmcloud.com/vulnerabilities/96693	vdb-entry, x_refsource_XF
	http://www.securityfocus.com/bid/70156	vdb-entry, x_refsource_BID
	http://www.openwall.com/lists/oss-security/2014/09/26/28	mailing-list, x_refsource_MLIST
	https://groups.google.com/forum/#%21msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T12:40:19.112Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "go-cve20147189-sec-bypass(96693)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96693"
          },
          {
            "name": "70156",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70156"
          },
          {
            "name": "[oss-security] 20140926 Re: CVE Request: Go crypto/tls vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/09/26/28"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-09-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-07T15:57:01",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "name": "go-cve20147189-sec-bypass(96693)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96693"
        },
        {
          "name": "70156",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70156"
        },
        {
          "name": "[oss-security] 20140926 Re: CVE Request: Go crypto/tls vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/09/26/28"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@ubuntu.com",
          "ID": "CVE-2014-7189",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "go-cve20147189-sec-bypass(96693)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96693"
            },
            {
              "name": "70156",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70156"
            },
            {
              "name": "[oss-security] 20140926 Re: CVE Request: Go crypto/tls vulnerability",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2014/09/26/28"
            },
            {
              "name": "https://groups.google.com/forum/#!msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2014-7189",
    "datePublished": "2014-10-07T14:00:00",
    "dateReserved": "2014-09-26T00:00:00",
    "dateUpdated": "2024-08-06T12:40:19.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

opensuse-su-2024:10811-1

Vulnerability from csaf_opensuse

CVE-2017-15042 (GCVE-0-2017-15042)

Vulnerability from cvelistv5

CVE-2016-5386 (GCVE-0-2016-5386)

Vulnerability from cvelistv5

CVE-2017-15041 (GCVE-0-2017-15041)

Vulnerability from cvelistv5

CVE-2014-7189 (GCVE-0-2014-7189)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature