Medium: golang

Issue Overview:

A flaw was found in Go, acting as an unintended proxy or intermediary, where ReverseProxy forwards connection headers if the first one was empty. This flaw allows an attacker to drop arbitrary headers. The highest threat from this vulnerability is to integrity. (CVE-2021-33197)

A flaw was found in Go, where it attempts to allocate excessive memory. This issue may cause panic or unrecoverable fatal error if passed inputs with very large exponents. The highest threat from this vulnerability is to system availability. (CVE-2021-33198)

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate’s private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with Config.InsecureSkipVerify. Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0-1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected. (CVE-2021-34558)

Affected Packages:

golang

Issue Correction:
Run yum update golang to update your system.

New Packages:

i686:  
    golang-1.15.14-1.69.amzn1.i686  
    golang-bin-1.15.14-1.69.amzn1.i686  
  
noarch:  
    golang-tests-1.15.14-1.69.amzn1.noarch  
    golang-misc-1.15.14-1.69.amzn1.noarch  
    golang-docs-1.15.14-1.69.amzn1.noarch  
    golang-src-1.15.14-1.69.amzn1.noarch  
  
src:  
    golang-1.15.14-1.69.amzn1.src  
  
x86_64:  
    golang-1.15.14-1.69.amzn1.x86_64  
    golang-race-1.15.14-1.69.amzn1.x86_64  
    golang-bin-1.15.14-1.69.amzn1.x86_64  

Additional References

Red Hat: CVE-2021-33197, CVE-2021-33198, CVE-2021-34558

Mitre: CVE-2021-33197, CVE-2021-33198, CVE-2021-34558