netapp cloud insights telegraf - vulnerabilities and exploits

(subscribe to this query)

NA

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an malicious user to cause a panic due to stack exhaustion via a deeply nested XML document.

Golang Go Fedoraproject Fedora 35 Netapp Cloud Insights Telegraf -

NA

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows malicious user to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

Golang Go Netapp Cloud Insights Telegraf Agent -

7.8

CVSSv2

Rat.SetString in math/big in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -Debian Debian Linux 9.0

5 Github repositories

5

CVSSv2

cmd/go in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -

4 Github repositories

6.4

CVSSv2

Curve.IsOnCurve in crypto/elliptic in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -Debian Debian Linux 9.0

3 Github repositories

5

CVSSv2

In archive/zip in Go prior to 1.16.8 and 1.17.x prior to 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

Golang Go Netapp Cloud Insights Telegraf -

5

CVSSv2

net/http in Go prior to 1.16.12 and 1.17.x prior to 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

Golang Go Debian Debian Linux 9.0 Netapp Cloud Insights Telegraf -

7.5

CVSSv2

Go prior to 1.15.13 and 1.16.x prior to 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

Golang Go Netapp Cloud Insights Telegraf Agent -

2.6

CVSSv2

The crypto/tls package of Go up to and including 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Golang Go Fedoraproject Fedora 33 Fedoraproject Fedora 34 Netapp Storagegrid -Netapp Trident -Netapp Cloud Insights Telegraf -Oracle Timesten In-memory Database

1 Github repository

6.4

CVSSv2

In Go prior to 1.14.14 and 1.15.x prior to 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

Golang Go Fedoraproject Fedora 33 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -

1 Github repository

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook