Most recent entries from all

ALSA-2021:5160 — Important: go-toolset:rhel8 security and bug fix update

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: net/http: limit growth of header canonicalization cache (CVE-2021-44716)

* golang: syscall: don't close fd 0 on ForkExec error (CVE-2021-44717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Rebase Go to 1.16.12 (BZ#2031125)

Withdrawn: BELL-CVE-2021-44717 — CVE-2021-44717 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2021-44717

Affected: Bitnami: golang

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

certfr-2021-avi-942 — De multiples vulnérabilités ont été découvertes dans GitLab les produits GitLab. Elles permettent à un attaquant de pro…

certfr-2021-avi-942

EUVD-2026-33065

fkie_cve-2021-44717

GHSA-x9r7-cjm2-h6cp

gsd-2021-44717

ICSA-23-047-04 — Siemens Brownfield Connectivity Gateway

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field. net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion. encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic. The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

OESA-2022-1661 — golang security update

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP3: golang, openEuler:22.03-LTS: golang

The Go Programming Language. Security Fix(es): Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.(CVE-2021-44717)

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.(CVE-2022-24675) The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.(CVE-2022-28327)

openSUSE-SU-2021:1626-1 — Security update for go1.16

Security update for go1.16

RHEA-2022:1596 — Red Hat Enhancement Advisory: OpenShift Virtualization 4.9.4 Images

golang: net/http/httputil: panic due to racy read of persistConn after handler panic golang: net/http: limit growth of header canonicalization cache golang: syscall: don't close fd 0 on ForkExec error

SUSE-SU-2021:4169-1 — Security update for go1.16

Security update for go1.16

UBUNTU-CVE-2021-44717

Affected: Ubuntu:18.04:LTS: golang-1.8, Ubuntu:22.04:LTS: golang-1.17

WID-SEC-W-2022-0967 — Red Hat Enterprise Linux (go-toolset): Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux und Oracle Linux ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.