Vulnerable Library - github.com/denisenkom/go-MSSQLdb-v0.10.0
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Vulnerabilities
| CVE |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (github.com/denisenkom/go-MSSQLdb-v0.10.0 version) |
Remediation Available |
| CVE-2022-27191 |
 High |
7.5 |
github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 |
Transitive |
N/A* |
❌ |
| CVE-2020-9283 |
High |
7.5 |
github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 |
Transitive |
N/A* |
❌ |
| CVE-2020-29652 |
High |
7.5 |
github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 |
Transitive |
N/A* |
❌ |
| CVE-2021-43565 |
High |
7.5 |
github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 |
Transitive |
N/A* |
❌ |
| CVE-2020-7919 |
High |
7.5 |
github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 |
Transitive |
N/A* |
❌ |
| CVE-2019-11841 |
 Medium |
5.9 |
github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2022-27191
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
- github.com/denisenkom/go-MSSQLdb-v0.10.0 (Root Library)
- ❌ github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 (Vulnerable Library)
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
Publish Date: 2022-03-18
URL: CVE-2022-27191
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-27191
Release Date: 2022-03-18
Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20220315.3147a52-1;golang-go.crypto-dev - 1:0.0~git20220315.3147a52-1
Step up your Open Source Security Game with Mend here
CVE-2020-9283
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
- github.com/denisenkom/go-MSSQLdb-v0.10.0 (Root Library)
- ❌ github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 (Vulnerable Library)
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Publish Date: 2020-02-20
URL: CVE-2020-9283
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
Release Date: 2020-02-20
Fix Resolution: github.com/golang/crypto - bac4c82f69751a6dd76e702d54b3ceb88adab236
Step up your Open Source Security Game with Mend here
CVE-2020-29652
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
- github.com/denisenkom/go-MSSQLdb-v0.10.0 (Root Library)
- ❌ github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 (Vulnerable Library)
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
Publish Date: 2020-12-17
URL: CVE-2020-29652
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
Release Date: 2020-12-17
Fix Resolution: v0.0.0-20201216223049-8b5274cf687f
Step up your Open Source Security Game with Mend here
CVE-2021-43565
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
- github.com/denisenkom/go-MSSQLdb-v0.10.0 (Root Library)
- ❌ github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 (Vulnerable Library)
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
Publish Date: 2022-09-06
URL: CVE-2021-43565
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43565
Release Date: 2021-11-10
Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20211202.5770296-1;golang-go.crypto-dev - 1:0.0~git20211202.5770296-1
Step up your Open Source Security Game with Mend here
CVE-2020-7919
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
- github.com/denisenkom/go-MSSQLdb-v0.10.0 (Root Library)
- ❌ github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 (Vulnerable Library)
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
Publish Date: 2020-03-16
URL: CVE-2020-7919
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7919
Release Date: 2020-03-16
Fix Resolution: go - 1.12.16,1.13.7;crypto - v0.0.0-20200128174031-69ecbb4d6d5d
Step up your Open Source Security Game with Mend here
CVE-2019-11841
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
- github.com/denisenkom/go-MSSQLdb-v0.10.0 (Root Library)
- ❌ github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692 (Vulnerable Library)
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The "Hash" Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures.
Publish Date: 2019-05-22
URL: CVE-2019-11841
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-11841
Release Date: 2019-05-22
Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20200221.2aa609c-1,1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1,1:0.0~git20200221.2aa609c-1;golang-go.crypto-dev - 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1,1:0.0~git20200221.2aa609c-1,1:0.0~git20200221.2aa609c-1
Step up your Open Source Security Game with Mend here
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
Publish Date: 2022-03-18
URL: CVE-2022-27191
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-27191
Release Date: 2022-03-18
Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20220315.3147a52-1;golang-go.crypto-dev - 1:0.0~git20220315.3147a52-1
Step up your Open Source Security Game with Mend here
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Publish Date: 2020-02-20
URL: CVE-2020-9283
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
Release Date: 2020-02-20
Fix Resolution: github.com/golang/crypto - bac4c82f69751a6dd76e702d54b3ceb88adab236
Step up your Open Source Security Game with Mend here
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
Publish Date: 2020-12-17
URL: CVE-2020-29652
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
Release Date: 2020-12-17
Fix Resolution: v0.0.0-20201216223049-8b5274cf687f
Step up your Open Source Security Game with Mend here
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
Publish Date: 2022-09-06
URL: CVE-2021-43565
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43565
Release Date: 2021-11-10
Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20211202.5770296-1;golang-go.crypto-dev - 1:0.0~git20211202.5770296-1
Step up your Open Source Security Game with Mend here
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
Publish Date: 2020-03-16
URL: CVE-2020-7919
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7919
Release Date: 2020-03-16
Fix Resolution: go - 1.12.16,1.13.7;crypto - v0.0.0-20200128174031-69ecbb4d6d5d
Step up your Open Source Security Game with Mend here
Vulnerable Library - github.com/golang/crypto-v0.0.0-20190403202508-8e1b8d32e692
[mirror] Go supplementary cryptography libraries
Library home page: https://proxy.golang.org/github.com/golang/crypto/@v/v0.0.0-20190403202508-8e1b8d32e692.zip
Dependency Hierarchy:
Found in HEAD commit: 0b34798e47770cd5cdb86f04f918575251d92f0c
Found in base branch: main
Vulnerability Details
A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The "Hash" Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures.
Publish Date: 2019-05-22
URL: CVE-2019-11841
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-11841
Release Date: 2019-05-22
Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20200221.2aa609c-1,1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1,1:0.0~git20200221.2aa609c-1;golang-go.crypto-dev - 1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1,1:0.0~git20200221.2aa609c-1,1:0.0~git20200221.2aa609c-1
Step up your Open Source Security Game with Mend here