Date: Sat, 19 Mar 2022 22:35:59 GMT From: Guangyuan Yang <ygy@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: ab78e7f80fac - main - security/vuxml: Document lang/go vulnerabilities Message-ID: <202203192235.22JMZxx3081979@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by ygy: URL: https://cgit.FreeBSD.org/ports/commit/?id=ab78e7f80fac7a41b6e21a5e4517dce28d9d36a9 commit ab78e7f80fac7a41b6e21a5e4517dce28d9d36a9 Author: Guangyuan Yang <ygy@FreeBSD.org> AuthorDate: 2022-03-19 22:34:44 +0000 Commit: Guangyuan Yang <ygy@FreeBSD.org> CommitDate: 2022-03-19 22:34:44 +0000 security/vuxml: Document lang/go vulnerabilities --- security/vuxml/vuln-2022.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index d6339c35bb9a..bdfff5e2b369 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,33 @@ + <vuln vid="e2af876f-a7c8-11ec-9a2a-002324b2fba8"> + <topic>go -- multiple vulnerabilities</topic> + <affects> + <package> + <name>go</name> + <range><lt>1.17.8,1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Go project reports:</p> + <blockquote cite="https://github.com/golang/go/issues/51112">; + <p>regexp: stack exhaustion compiling deeply nested expressions</p> + <p>On 64-bit platforms, an extremely deeply nested expression can + cause regexp.Compile to cause goroutine stack exhaustion, forcing + the program to exit. Note this applies to very large expressions, on + the order of 2MB.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2022-24921</cvename> + <url>https://github.com/golang/go/issues/51112</url>; + </references> + <dates> + <discovery>2022-02-09</discovery> + <entry>2022-03-19</entry> + </dates> + </vuln> + <vuln vid="45a72180-a640-11ec-a08b-85298243e224"> <topic>openvpn -- Potential authentication by-pass with multiple deferred authentication plug-ins</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202203192235.22JMZxx3081979>