Moderate: go-toolset and golang security and bug fix update

2023-01-2300:00:00

errata.almalinux.org

go toolset

golang packages

security fix

bug fix

memory consumption

reverseproxy

regexps

cvss score

internal linking

crypto testcases

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

60.1%

JSON

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The golang packages provide the Go programming language compiler.

Security Fix(es):

golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Internal linking fails on ppc64le (BZ#2144547)
crypto testcases fail on golang on s390x [almalinux-9] (BZ#2149311)

OSVersionArchitecturePackageVersionFilename
almalinux9noarchgolang-tests< 1.18.9-1.el9_1golang-tests-1.18.9-1.el9_1.noarch.rpm
almalinux9noarchgolang-docs< 1.18.9-1.el9_1golang-docs-1.18.9-1.el9_1.noarch.rpm
almalinux9noarchgolang-misc< 1.18.9-1.el9_1golang-misc-1.18.9-1.el9_1.noarch.rpm
almalinux9noarchgolang-src< 1.18.9-1.el9_1golang-src-1.18.9-1.el9_1.noarch.rpm
almalinux9x86_64golang-race< 1.18.9-1.el9_1golang-race-1.18.9-1.el9_1.x86_64.rpm
almalinux9x86_64go-toolset< 1.18.9-1.el9_1go-toolset-1.18.9-1.el9_1.x86_64.rpm
almalinux9x86_64golang-bin< 1.18.9-1.el9_1golang-bin-1.18.9-1.el9_1.x86_64.rpm
almalinux9x86_64golang< 1.18.9-1.el9_1golang-1.18.9-1.el9_1.x86_64.rpm
almalinux9ppc64legolang< 1.18.9-1.el9_1golang-1.18.9-1.el9_1.ppc64le.rpm
almalinux9ppc64legolang-bin< 1.18.9-1.el9_1golang-bin-1.18.9-1.el9_1.ppc64le.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	9	noarch	golang-tests	< 1.18.9-1.el9_1	golang-tests-1.18.9-1.el9_1.noarch.rpm
almalinux	9	noarch	golang-docs	< 1.18.9-1.el9_1	golang-docs-1.18.9-1.el9_1.noarch.rpm
almalinux	9	noarch	golang-misc	< 1.18.9-1.el9_1	golang-misc-1.18.9-1.el9_1.noarch.rpm
almalinux	9	noarch	golang-src	< 1.18.9-1.el9_1	golang-src-1.18.9-1.el9_1.noarch.rpm
almalinux	9	x86_64	golang-race	< 1.18.9-1.el9_1	golang-race-1.18.9-1.el9_1.x86_64.rpm
almalinux	9	x86_64	go-toolset	< 1.18.9-1.el9_1	go-toolset-1.18.9-1.el9_1.x86_64.rpm
almalinux	9	x86_64	golang-bin	< 1.18.9-1.el9_1	golang-bin-1.18.9-1.el9_1.x86_64.rpm
almalinux	9	x86_64	golang	< 1.18.9-1.el9_1	golang-1.18.9-1.el9_1.x86_64.rpm
almalinux	9	ppc64le	golang	< 1.18.9-1.el9_1	golang-1.18.9-1.el9_1.ppc64le.rpm
almalinux	9	ppc64le	golang-bin	< 1.18.9-1.el9_1	golang-bin-1.18.9-1.el9_1.ppc64le.rpm