Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/dhowden/tag < 0.0.0-20201120070457-d52dcb253c63
Fixed in
0.0.0-20201120070457-d52dcb253c63· Vendor fix available
Issue
dhowden tag before 0.0.0-20201120070457-d52dcb253c63 allows panic: runtime error: index out of range via readPICFrame.
Recommended action: Upgrade to 0.0.0-20201120070457-d52dcb253c63 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/dhowden/tag < 0.0.0-20201120070457-d52dcb253c63
Fixed in
0.0.0-20201120070457-d52dcb253c63· Vendor fix available
Issue
Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAtomData due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
Recommended action: Upgrade to 0.0.0-20201120070457-d52dcb253c63 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/dhowden/tag < 0.0.0-20201120070457-d52dcb253c63
Fixed in
0.0.0-20201120070457-d52dcb253c63· Vendor fix available
Issue
Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
Recommended action: Upgrade to 0.0.0-20201120070457-d52dcb253c63 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/dhowden/tag < 0.0.0-20201120070457-d52dcb253c63
Fixed in
0.0.0-20201120070457-d52dcb253c63· Vendor fix available
Issue
Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAPICFrame due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
Recommended action: Upgrade to 0.0.0-20201120070457-d52dcb253c63 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.