QID 354041

a null pointer dereference vulnerability was found in golang.
When using the librarys ssh server without specifying an option for gssapiwithmicconfig, it is possible for an attacker to craft an ssh client connection using the authentication method and cause the server to panic resulting in a denial of service.
The highest threat from this vulnerability is to system availability. (
( CVE-2020-29652) an infinite loop vulnerability was found in golang.
If an application defines a custom token parser initializing with `xml.
Newtokendecoder` it is possible for the parsing loop to never return.
An attacker could potentially craft a malicious xml document which has an xml element with `eof` within it, causing the parsing application to endlessly loop, resulting in a denial of service (dos). (
( CVE-2021-27918) an out of bounds read vulnerability was found in golang.
When using the archive/zip standard library (stdlib) and an unexpected file is parsed, it can cause golang to attempt to read outside of a slice (array) causing a panic in the runtime.
A potential attacker can use this vulnerability to craft an archive which causes an application using this library to crash resulting in a denial of service (dos). (
( CVE-2021-27919) a flaw was found in go.
The lookupcname, lookupsrv, lookupmx, lookupns, and lookupaddr functions in the net package and methods on the resolver type, may return arbitrary values retrieved from dns, allowing injection of unexpected contents.
The highest threat from this vulnerability is to integrity. (
This flaw allows an attacker to drop arbitrary headers.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.