Debian Golang-1.19 vulnerabilities

CVE-2023-29406 [MEDIUM] CVE-2023-29406: golang-1.15 - The HTTP/1 client does not fully validate the contents of the Host header. A mal... The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. Scope: local bullseye: open

CVE-2023-24532 [MEDIUM] CVE-2023-24532: golang-1.15 - The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorr... The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh. Scope: local bullseye: open

CVE-2023-39319 [MEDIUM] CVE-2023-39319: golang-1.15 - The html/template package does not apply the proper rules for handling occurrenc... The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Scope: local bullseye: open

CVE-2023-45289 [MEDIUM] CVE-2023-45289: golang-1.15 - When following an HTTP redirect to a domain which is not a subdomain match or ex... When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect

CVE-2023-45290 [MEDIUM] CVE-2023-45290: golang-1.15 - When parsing a multipart form (either explicitly with Request.ParseMultipartForm... When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause all

CVE-2023-45283 [HIGH] CVE-2023-45283: golang-1.15 - The filepath package does not recognize paths with a \??\ prefix as special. On ... The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean cou

CVE-2023-45284 [MEDIUM] CVE-2023-45284: golang-1.15 - On Windows, The IsLocal function does not correctly detect reserved device names... On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local. Scope: local bullseye: open

CVE-2022-2880 [HIGH] CVE-2022-2880: golang-1.15 - Requests forwarded by ReverseProxy include the raw query parameters from the inb... Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form

CVE-2022-30632 [HIGH] CVE-2022-30632: golang-1.15 - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 ... Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators. Scope: local bullseye: open

CVE-2022-41723 [HIGH] CVE-2022-41723: golang-1.15 - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the... A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. Scope: local bullseye: open

CVE-2022-30633 [HIGH] CVE-2022-30633: golang-1.15 - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.1... Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag. Scope: local bullseye: open

CVE-2022-2879 [HIGH] CVE-2022-2879: golang-1.15 - Reader.Read does not set a limit on the maximum size of file headers. A maliciou... Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. Scope: local bullseye: open

CVE-2022-30631 [HIGH] CVE-2022-30631: golang-1.15 - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go ... Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files. Scope: local bullseye: open

CVE-2022-27664 [HIGH] CVE-2022-27664: golang-1.15 - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a ... In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. Scope: local bullseye: open

CVE-2022-32189 [HIGH] CVE-2022-32189: golang-1.15 - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDeco... A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. Scope: local bullseye: open

CVE-2022-30635 [HIGH] CVE-2022-30635: golang-1.15 - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and G... Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures. Scope: local bullseye: open

CVE-2022-41715 [HIGH] CVE-2022-41715: golang-1.15 - Programs which compile regular expressions from untrusted sources may be vulnera... Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being pars

CVE-2022-41724 [HIGH] CVE-2022-41724: golang-1.15 - Large handshake records may cause panics in crypto/tls. Both clients and servers... Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value)

CVE-2022-41725 [HIGH] CVE-2022-41725: golang-1.15 - A denial of service is possible from excessive resource consumption in net/http ... A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. R

CVE-2022-1962 [MEDIUM] CVE-2022-1962: golang-1.15 - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and... Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. Scope: local bullseye: open