Search CVE reports
11 – 20 of 1648 results
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet...
1 affected package
golang-github-gopacket-gopacket
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-gopacket-gopacket | Needs evaluation | Needs evaluation | Not in release | — | — |
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a...
2 affected packages
golang-github-go-git-go-git, golang-github-go-git-go-git-v6
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-go-git-go-git | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-github-go-git-go-git-v6 | Not in release | Not in release | Not in release | — | — |
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining...
2 affected packages
golang-github-go-git-go-git, golang-github-go-git-go-git-v6
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-go-git-go-git | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-github-go-git-go-git-v6 | Not in release | Not in release | Not in release | — | — |
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of...
2 affected packages
golang-github-pion-stun, golang-github-pion-stun-v3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-pion-stun | Needs evaluation | Needs evaluation | Not in release | — | — |
| golang-github-pion-stun-v3 | Needs evaluation | Not in release | Not in release | — | — |