netapp cloud insights telegraf agent - vulnerabilities and exploits

(subscribe to this query)

NA

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows malicious user to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

Golang Go Netapp Cloud Insights Telegraf Agent -

7.8

CVSSv2

Rat.SetString in math/big in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -Debian Debian Linux 9.0

5 Github repositories

5

CVSSv2

cmd/go in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -

4 Github repositories

6.4

CVSSv2

Curve.IsOnCurve in crypto/elliptic in Go prior to 1.16.14 and 1.17.x prior to 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

Golang Go Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -Netapp Kubernetes Monitoring Operator -Netapp Beegfs Csi Driver -Debian Debian Linux 9.0

3 Github repositories

7.5

CVSSv2

Go prior to 1.15.13 and 1.16.x prior to 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

Golang Go Netapp Cloud Insights Telegraf Agent -

6.4

CVSSv2

In Go prior to 1.14.14 and 1.15.x prior to 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

Golang Go Fedoraproject Fedora 33 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -

1 Github repository

5.1

CVSSv2

Go prior to 1.14.14 and 1.15.x prior to 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Golang Go Fedoraproject Fedora 33 Netapp Storagegrid -Netapp Cloud Insights Telegraf Agent -

5

CVSSv2

Go prior to 1.14.12 and 1.15.x prior to 1.15.4 allows Denial of Service.

Golang Go Fedoraproject Fedora 32 Fedoraproject Fedora 33 Netapp Trident -Netapp Cloud Insights Telegraf Agent -

5.1

CVSSv2

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Golang Go Fedoraproject Fedora 32 Fedoraproject Fedora 33 Netapp Trident -Netapp Cloud Insights Telegraf Agent -

5

CVSSv2

Go prior to 1.12.10 and 1.13.x prior to 1.13.1 allow HTTP Request Smuggling.

Golang Go Debian Debian Linux 9.0 Opensuse Leap 15.0 Opensuse Leap 15.1 Fedoraproject Fedora 29 Fedoraproject Fedora 30 Fedoraproject Fedora 31 Redhat Openshift Container Platform 4.2 Redhat Enterprise Linux 8.0 Redhat Developer Tools 1.0 Redhat Enterprise Linux Eus 8.1 Netapp Cloud Insights Telegraf Agent -

1 Github repository

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook