MGASA-2022-0356

Advisory lineage Upstream: 2 Downstream: 0
Published: 05 Oct 2022, 05:23
Last modified:16 Apr 2026, 04:42

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Oct 2022, 05:23
Published
Vulnerability first disclosed
16 Apr 2026, 04:42
Last Modified
Vulnerability information updated

Description

Updated golang packages fix security vulnerability In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664) JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result. (CVE-2022-32190)

Affected Systems

  • mageia•golang

    < 1.18.6-1.mga8

References (5)