Search CVE reports
11 – 14 of 14 results
Some fixes available 26 of 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
17 affected packages
golang-1.13, golang-1.14, golang-1.16, golang-1.17, golang-1.18...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.13 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.14 | — | — | Not in release | Vulnerable | Not in release |
| golang-1.16 | — | — | Not in release | Fixed | Fixed |
| golang-1.17 | — | — | Vulnerable | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.8 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.9 | — | — | Not in release | Not in release | Vulnerable |
| google-guest-agent | Fixed | Fixed | Fixed | Fixed | Needs evaluation |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| golang | — | — | Not in release | Not in release | Not in release |
| golang-1.10 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.6 | — | — | Not in release | Not in release | Not in release |
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud....
4 affected packages
golang-github-dgrijalva-jwt-go, golang-github-coreos-discovery-etcd-io, juju-core, telegraf
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-dgrijalva-jwt-go | Not in release | Not in release | Not affected | Needs evaluation | Needs evaluation |
| golang-github-coreos-discovery-etcd-io | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Not in release |
| juju-core | Not in release | Not in release | Not in release | Not in release | Not in release |
| telegraf | Not in release | Not in release | Not affected | Not in release | Not in release |
Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
1 affected package
juju-core
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| juju-core | — | — | — | — | — |
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
2 affected packages
juju-core, juju-core-1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| juju-core | — | — | — | — | — |
| juju-core-1 | — | — | — | — | — |