golang.org/x/mod-v0.4.2: 6 vulnerabilities (highest severity is: 7.5) #1160
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Path to dependency file: /go_modules/helpers/go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.mod
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - golang.org/x/crypto-v0.0.0-20191011191535-87dc89f01550
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.zip
Path to dependency file: /go_modules/helpers/go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.mod
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
Publish Date: 2022-03-18
URL: CVE-2022-27191
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-27191
Release Date: 2022-03-18
Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20220315.3147a52-1;golang-go.crypto-dev - 1:0.0~git20220315.3147a52-1
Vulnerable Library - golang.org/x/crypto-v0.0.0-20191011191535-87dc89f01550
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.zip
Path to dependency file: /go_modules/helpers/go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.mod
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
Publish Date: 2022-09-06
URL: CVE-2021-43565
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43565
Release Date: 2021-11-10
Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20211202.5770296-1;golang-go.crypto-dev - 1:0.0~git20211202.5770296-1
Vulnerable Library - golang.org/x/crypto-v0.0.0-20191011191535-87dc89f01550
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.zip
Path to dependency file: /go_modules/helpers/go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.mod
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Publish Date: 2020-02-20
URL: CVE-2020-9283
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
Release Date: 2020-02-20
Fix Resolution: github.com/golang/crypto - bac4c82f69751a6dd76e702d54b3ceb88adab236
Vulnerable Library - golang.org/x/crypto-v0.0.0-20191011191535-87dc89f01550
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.zip
Path to dependency file: /go_modules/helpers/go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.mod
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
Publish Date: 2020-03-16
URL: CVE-2020-7919
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7919
Release Date: 2020-03-16
Fix Resolution: go - 1.12.16,1.13.7;crypto - v0.0.0-20200128174031-69ecbb4d6d5d
Vulnerable Library - golang.org/x/crypto-v0.0.0-20191011191535-87dc89f01550
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.zip
Path to dependency file: /go_modules/helpers/go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.mod
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
Publish Date: 2020-12-17
URL: CVE-2020-29652
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
Release Date: 2020-12-17
Fix Resolution: v0.0.0-20201216223049-8b5274cf687f
Vulnerable Library - golang.org/x/crypto-v0.0.0-20191011191535-87dc89f01550
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.zip
Path to dependency file: /go_modules/helpers/go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20191011191535-87dc89f01550.mod
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/....\asd becomes ....\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened. Since the controlled path is suffixed with +http-01 before opening, the impact of this is significantly limited, since it only allows reading arbitrary files on the system if and only if they have this suffix.
Publish Date: 2024-07-02
URL: CVE-2022-30636
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-30636
Release Date: 2024-07-02
Fix Resolution: github.com/golang/crypto-v0.1.0
The text was updated successfully, but these errors were encountered: