| Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSONCVE-2024-24786 · GHSA-8R3F-844C-MC37Version ranges need review. |
google.golang.org/protobuf/encoding/protojsongoogle.golang.org/protobuf/internal/encoding/json |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325 · GHSA-4374-P667-P6C8Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| go-retryablehttp can leak basic auth credentials to log filesCVE-2024-6104 · GHSA-V6V8-XJ6M-XWQHVersion ranges need review. |
github.com/hashicorp/go-retryablehttpOpenShift API for Data Protection/oadp/oadp-kubevirt-velero-plugin-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| github.com/containers/image allows unexpected authenticated registry accessesCVE-2024-3727 · GHSA-6WVF-F2VW-3425Version ranges need review. |
github.com/containers/image/v5github.com/containers/image |
GoRed Hat |
High
|
Fix reported |
|
| Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)CVE-2024-28180 · GHSA-C5Q2-7R4C-MV6GVersion ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| otelgrpc DoS vulnerability due to unbound cardinality metrics CVE-2023-47108 · GHSA-8PGV-569H-W5RWVersion ranges need review. |
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcLogical Volume Manager Storage/lvms4/lvms-rhel9-operator |
GoRed Hat |
High
|
Fix reported |
|
| OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metricsCVE-2023-45142 · GHSA-RCJV-MGP8-QVMRVersion ranges need review. |
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestfulgo.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin |
GoRed Hat |
High
|
Fix reported |
|
| Stack exhaustion in Parse in go/build/constraintCVE-2024-34158 · GO-2024-3107 |
stdlibMachine Deletion Remediation Operator/workload-availability/machine-deletion-remediation-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Memory exhaustion when compiling regular expressions in regexp/syntaxCVE-2022-41715 · GO-2022-1039 |
stdlibMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Failure to strip relative path components in net/urlCVE-2022-32190 · GO-2022-0988 |
stdlibNode HealthCheck Operator/workload-availability/node-healthcheck-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipCVE-2024-24790 · GO-2024-2887 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Stack exhaustion in all Parse functions in go/parserCVE-2024-34155 · GO-2024-3105 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Excessive memory allocation in net/http and net/textprotoCVE-2023-24534 · GO-2023-1704 |
stdlibNode HealthCheck Operator/workload-availability/node-healthcheck-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/http2 vulnerable to possible excessive memory growthCVE-2022-41717 · GHSA-XRJJ-MJ9H-534MVersion ranges need review. |
golang.org/x/net/http2golang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| Backticks not treated as string delimiters in html/templateCVE-2023-24538 · GO-2023-1703 |
stdlibNode HealthCheck Operator/workload-availability/node-healthcheck-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| net/http, x/net/http2: close connections when receiving too many headersCVE-2023-45288 · GHSA-4V7X-PQXF-CX7MVersion ranges need review. |
golang.org/x/net/http2golang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelCVE-2023-45287 · GO-2023-2375 |
stdlibCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Improper handling of JavaScript whitespace in html/templateCVE-2023-24540 · GO-2023-1752 |
stdlibCustom Metric Autoscaler operator for Red Hat Openshift/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Excessive resource consumption in net/http, net/textproto and mime/multipartCVE-2023-24536 · GO-2023-1705 |
stdlibNode HealthCheck Operator/workload-availability/node-healthcheck-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Infinite loop in parsing in go/scannerCVE-2023-24537 · GO-2023-1702 |
stdlibNode HealthCheck Operator/workload-availability/node-healthcheck-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
