argo-cd10.6.4

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Authentication Bypass in dex

Critical security issues in XML encoding in github.com/dexidp/dex

gRPC-Go has an authorization bypass via missing leading slash in :path

Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto doesn't enforce invoking key constraints

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Go JOSE Panics in JWE decryption

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

go-billy has path traversal vulnerabilities

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

go-ntlmssp NTLM challenges can panic on malformed payloads

go-git: Worktree operations may follow symlinks

Memory exhaustion in query parameter parsing in net/url

validateSignature Loop Variable Capture Signature Bypass in goxmldsig

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

go-git: Malicious reference names may modify files outside the reference storage

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

CIRCL has an incorrect calculation in secp384r1 CombinedMult

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Go Net HTML parser is vulnerable to denial of service

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

slack-go `SecretsVerifier` accepts empty signing secret without precondition

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking