Search CVE reports
1 – 10 of 1641 results
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil...
1 affected package
golang-github-getkin-kin-openapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-getkin-kin-openapi | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying...
1 affected package
libgit2
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| libgit2 | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this...
1 affected package
golang-github-sigstore-sigstore
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-sigstore-sigstore | Needs evaluation | Needs evaluation | Not in release | — | — |
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet...
1 affected package
golang-github-gopacket-gopacket
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-gopacket-gopacket | Needs evaluation | Needs evaluation | Not in release | — | — |
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a...
2 affected packages
golang-github-go-git-go-git, golang-github-go-git-go-git-v6
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-go-git-go-git | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-github-go-git-go-git-v6 | Not in release | Not in release | Not in release | — | — |
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining...
2 affected packages
golang-github-go-git-go-git, golang-github-go-git-go-git-v6
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-github-go-git-go-git | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-github-go-git-go-git-v6 | Not in release | Not in release | Not in release | — | — |
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options...
1 affected package
python-git
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python-git | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |