Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An attacker could possibly use this issue to run arbitrary commands. (CVE-2023-24531)
Sohom Datta discovered that Go did not properly validate backticks (`) as Javascript string delimiters, and did not escape them as expected. An attacker could possibly use this issue to inject arbitrary Javascript code into the Go template. (CVE-2023-24538)
Juho Nurminen discovered that Go incorrectly handled certain special characters in directory or file paths. An attacker could possibly use this issue to inject code into the resulting binaries. (CVE-2023-29402)
Vincent Dehors discovered that Go incorrectly handled permission bits. An attacker could possibly use this issue to read or write files with elevated privileges. (CVE-2023-29403)
Juho Nurminen discovered that Go incorrectly handled certain crafted arguments. An attacker could possibly use this issue to execute arbitrary code at build time. (CVE-2023-29405)
It was discovered that Go incorrectly validated the contents of host headers. A remote attacker could possibly use this issue to inject additional headers or entire requests. (CVE-2023-29406)
Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)
It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the net/http module. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2023-39325)
It was discovered that the Go html/template module did not validate errors returned from MarshalJSON methods. An attacker could possibly use this issue to inject arbitrary code into the Go template. (CVE-2024-24785)
{ "availability": "No subscription required", "binaries": [ { "binary_version": "1.17.13-3ubuntu1.2", "binary_name": "golang-1.17" }, { "binary_version": "1.17.13-3ubuntu1.2", "binary_name": "golang-1.17-doc" }, { "binary_version": "1.17.13-3ubuntu1.2", "binary_name": "golang-1.17-go" }, { "binary_version": "1.17.13-3ubuntu1.2", "binary_name": "golang-1.17-go-dbgsym" }, { "binary_version": "1.17.13-3ubuntu1.2", "binary_name": "golang-1.17-src" } ] }