How many CVEs have a located fix in go.googlesource.com/go?

64 published CVEs have a fix traced to functions in go.googlesource.com/go, touching 162 functions across 75 files.

Which function in go.googlesource.com/go has been patched by the most CVEs?

downloadPackage in src/cmd/go/internal/get/get.go has been changed by 3 CVE fixes, from 2017 to 2018.

How large is a typical CVE fix in go.googlesource.com/go?

The median fix changes 18 lines. 58% of fixes change 20 lines or fewer, and 44% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

go

assembly

#62 of 500 repositories

go.googlesource.com/go

Name: go.googlesource.com/go: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 9, 2022

64

CVE fixes located

Published CVEs

162

Functions patched

Distinct function sites

75

Files patched

Distinct source files

2016–2022

Years covered

By CVE publication date

Overview

64 published CVEs have a fix traced to functions in go.googlesource.com/go, the earliest published in 2016. Those fixes changed 162 distinct functions across 75 files, in 236 patch hunks.

Among the 500 repositories tracked here, go.googlesource.com/go ranks #62 by the number of CVEs with a located fix.

Most patched functions

Functions in go.googlesource.com/go changed by the most CVE fixes.

Most patched files

Files in go.googlesource.com/go changed by the most CVE fixes.

1src/archive/zip/reader.go4 CVEs · 5 functions
2src/cmd/go/internal/work/exec.go3 CVEs · 10 functions
3src/cmd/go/internal/get/get.go3 CVEs · 1 functions
4src/net/http/h2_bundle.go2 CVEs · 11 functions
5src/syscall/dll_windows.go2 CVEs · 5 functions
6src/cmd/go/internal/get/vcs.go2 CVEs · 4 functions
7src/crypto/x509/verify.go2 CVEs · 4 functions
8src/encoding/xml/read.go2 CVEs · 4 functions
9src/crypto/elliptic/p224.go2 CVEs · 3 functions
10src/crypto/x509/root_darwin.go2 CVEs · 3 functions

Fix size

How much code a CVE fix in go.googlesource.com/go changes, with backports counted once.

18

Median lines changed

Added plus removed, per CVE

58%

Fixes of 20 lines or fewer

Share of CVE fixes

44%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in go.googlesource.com/go, and the functions each fix changed.

Exposure of client IP addresses in net/http
CVE-2022-32148Clone
Medium · CVSS 6.5
EPSS 1.4%2022-08-09
Stack exhaustion due to deeply nested types in go/parser
CVE-2022-1962incNestLev decNestLev bailout
Medium · CVSS 5.5
EPSS 0.9%2022-08-09
Empty Cmd.Path can trigger unintended binary in os/exec on Windows
CVE-2022-30580Start
High · CVSS 7.8
EPSS 0.6%2022-08-09
Panic when decoding Float and Rat types in math/big
CVE-2022-32189GobDecode
High · CVSS 7.5
EPSS 2.6%2022-08-09
Session tickets lack random ticket_age_add in crypto/tls
CVE-2022-30629sendSessionTickets
Low · CVSS 3.1
EPSS 1.1%2022-08-09
Stack exhaustion in Glob on certain paths in io/fs
CVE-2022-30630globWithLimit Glob
High · CVSS 7.5
EPSS 2.1%2022-08-09
Improper sanitization of Transfer-Encoding headers in net/http
CVE-2022-1705parseTransferEncoding
Medium · CVSS 6.5
EPSS 1.4%2022-08-09
Stack exhaustion when reading certain archives in compress/gzip
CVE-2022-30631Read
High · CVSS 7.5
EPSS 2.1%2022-08-09
Stack exhaustion when unmarshaling certain documents in encoding/xml
CVE-2022-30633unmarshal DecodeElement unmarshalPath
High · CVSS 7.5
EPSS 2.1%2022-08-09
Stack exhaustion when decoding certain messages in encoding/gob
CVE-2022-30635decIgnoreOpFor compileDec compileIgnoreSingle
High · CVSS 7.5
EPSS 1.8%2022-08-09
CVE-2022-30632
CVE-2022-30632globWithLimit Glob
High · CVSS 7.5
EPSS 2.1%2022-08-09
CVE-2022-29804
CVE-2022-29804Clean
High · CVSS 7.5
EPSS 2.3%2022-08-09

Get an alert for each new go.googlesource.com/go CVE, with the patched functions and AI-written analysis.

Monitor go CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

OISF/suricata65 CVEs python-pillow/Pillow66 CVEs glpi-project/glpi67 CVEs siyuan-note/siyuan67 CVEs mlflow/mlflow60 CVEs mintplex-labs/anything-llm69 CVEs backstage/backstage59 CVEs erlang/otp58 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in go.googlesource.com/go.

How many CVEs have a located fix in go.googlesource.com/go?: 64 published CVEs have a fix traced to functions in go.googlesource.com/go, touching 162 functions across 75 files.
Which function in go.googlesource.com/go has been patched by the most CVEs?: downloadPackage in src/cmd/go/internal/get/get.go has been changed by 3 CVE fixes, from 2017 to 2018.
How large is a typical CVE fix in go.googlesource.com/go?: The median fix changes 18 lines. 58% of fixes change 20 lines or fewer, and 44% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track go.googlesource.com/go CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing