Software Detail

Software Informaton Top

Programming

Software Detail

Number Of NVD

138

CRITICAL

HIGH

MEDIUM

LOW

URL	https://golang.org/
Explanation	It is a programming language developed by Google. It has a simple syntax and can be coded by anyone to look the same. It has been adopted by many companies because it is good at parallel processing and can perform well on multi-core systems. Since it is cross-compatible, it can be run in a variety of environments including Windows, Linux, Mac, and Android. As a result of prioritizing simplicity, there are some disadvantages such as the lack of exception handling (there are alternative functions), which is common in other languages. This may be implemented in the future. A major release is made about every 6 months. If a critical bug or security issue is fixed during the major release, a minor release is made. The last two major releases are supported and covered. Since major releases are made about every six months, the major version a year ago will no longer be supported.
Tag	オープンソース BSD License

Add Information URL

No	Type	Name	URL
1			https://github.com/golang/go/wiki/Go-Release-Cycle
2			https://golang.org/doc/devel/release.html
3			https://github.com/golang/go/wiki/MinorReleases
4			https://golang.org/security
5			https://golang.org/doc/copyright.html

List Of Product [ Click to show release history and vulnerability information ]

No	Name	Latest Version	Release date	Initial release	Critical	High	Medium	Low
121	go 1.21	1.21.13	Aug. 6, 2024	June 16, 2023	2	14	12	1
122	go 1.20	1.20.7	Aug. 1, 2023	Feb. 1, 2023	6	22	14	1
123	go 1.19	1.19.13	Sept. 6, 2023	Aug. 2, 2022	6	29	15	1
124	Go 1.18	1.18.10	Jan. 10, 2023	March 15, 2022	6	41	19	2
125	Go 1.17	1.17.13	Aug. 1, 2022	Aug. 16, 2021	8	47	20	2
126	Go 1.16	1.16.15	March 3, 2022	Feb. 16, 2021	8	53	27	2
127	Go 1.15	1.15.15	Aug. 4, 2021	Aug. 11, 2020	8	58	29	2
128	Go 1.14	1.14.15	Feb. 4, 2021	Feb. 25, 2020	8	58	31	2
129	Go 1.13	1.13.15	Aug. 6, 2020	Sept. 3, 2019	8	62	31	2
130	Go 1.12	1.12.17	Feb. 12, 2020	Feb. 25, 2019	10	63	31	2
131	go 1.9	1.9.7			11	66	32	2
132	go 1.8	1.8.7			11	66	33	2
133	go 1.7	1.7.6			11	69	33	2
134	go 1.6	1.6.4			11	71	33	2
135	go 1.5	1.5.4			11	72	33	2
136	go 1.4	1.4.3			14	70	33	2
137	go 1.3	1.3.3			14	70	34	2
138	go 1.2	1.20.7	Aug. 1, 2023		14	71	35	2
139	go 1.12	1.12.9			10	63	31	2
140	go 1.11	1.11.9			10	63	32	2
141	go 1.10	1.10.8			10	66	31	2
142	go 1.1	1.19.13	Sept. 6, 2023		14	72	35	2
143	go 1.0	1.0.3			15	70	33	2
144	go 0.0	0.0.0-20201203163018-be400aefbc4c			14	69	33	2

NVD Vulnerability Information

CRITICAL
HIGH
MEDIUM
LOW

No	CVSS3 CVSS2	Level Attach Vector	Title	CWE	CVE	cpe23Uri	or higher	or less	less than	Update date Published date	Show Affected	Exploit PoC Search
121	8.2 6.4	HIGH Network	Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recove…	CWE-770 Allocation of Resources Without Limits or Throttling	CVE-2019-6486	cpe:2.3:a:golang:go::	1.11.1		1.11.5 1.10.8	2024-11-21 13:46 2019-01-24	Show	GitHub Exploit DB Packet Storm

122	7.5 7.8	HIGH Network	The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs …	CWE-295 Improper Certificate Validation	CVE-2018-16875	cpe:2.3:a:golang:go::	1.11.0		1.11.3 1.10.6	2024-11-21 12:53 2018-12-14	Show	GitHub Exploit DB Packet Storm

123	8.1 6.8	HIGH Network	In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both …	-	CVE-2018-16874	cpe:2.3:a:golang:go::	1.11.0		1.11.3 1.10.6	2024-11-21 12:53 2018-12-14	Show	GitHub Exploit DB Packet Storm

124	8.1 6.8	HIGH Network	In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package th…	-	CVE-2018-16873	cpe:2.3:a:golang:go::	1.11.0		1.11.3 1.10.6	2024-11-21 12:53 2018-12-14	Show	GitHub Exploit DB Packet Storm

125	8.8 9.3	HIGH Network	The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remo…	CWE-78 OS Command	CVE-2018-7187	cpe:2.3:a:golang:go::	1.10		1.9.5 1.10.1	2024-11-21 13:11 2018-02-17	Show	GitHub Exploit DB Packet Storm

126	7.8 4.6	HIGH Local	Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, bec…	CWE-94 Code Injection	CVE-2018-6574	cpe:2.3:a:golang:go:1.9:* cpe:2.3:a:golang:go:1.9.3:* cpe:2.3:a:golang:go:1.9.2:* cpe:2.3:a:golang:go:1.9.1:*<…		1.8.6		2024-11-21 13:10 2018-02-8	Show	GitHub Exploit DB Packet Storm

127	9.8 7.5	CRITICAL Network	The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Co…	CWE-444 HTTP Request Smuggling	CVE-2015-5740	cpe:2.3:a:golang:go::		1.4.2		2024-11-21 11:33 2017-10-19	Show	GitHub Exploit DB Packet Storm

128	9.8 7.5	CRITICAL Network	The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instea…	CWE-444 HTTP Request Smuggling	CVE-2015-5739	cpe:2.3:a:golang:go::		1.4.2		2024-11-21 11:33 2017-10-19	Show	GitHub Exploit DB Packet Storm

129	5.9 4.3	MEDIUM Network	An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. T…	CWE-319 Cleartext Transmission of Sensitive Information	CVE-2017-15042	cpe:2.3:a:golang:go:1.9:* cpe:2.3:a:golang:go::		1.8.3		2024-11-21 12:13 2017-10-6	Show	GitHub Exploit DB Packet Storm

130	9.8 7.5	CRITICAL Network	Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but …	NVD-CWE-noinfo	CVE-2017-15041	cpe:2.3:a:golang:go:1.9:- cpe:2.3:a:golang:go::		1.8.3		2024-11-21 12:13 2017-10-6	Show	GitHub Exploit DB Packet Storm