(RHSA-2020:5493) Moderate: go-toolset:rhel8 security update

2020-12-1516:02:27

access.redhat.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.016 Low

EPSS

Percentile

87.0%

JSON

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS (CVE-2020-24553)
golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)
golang: malicious symbol names can lead to code execution at build time (CVE-2020-28366)
golang: improper validation of cgo flags can lead to code execution at build time (CVE-2020-28367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyppc64lego-toolset< 1.14.12-1.module+el8.3.0+8784+380394dcgo-toolset-1.14.12-1.module+el8.3.0+8784+380394dc.ppc64le.rpm
RedHatanyx86_64golang-race< 1.14.12-1.module+el8.3.0+8784+380394dcgolang-race-1.14.12-1.module+el8.3.0+8784+380394dc.x86_64.rpm
RedHatanynoarchgolang-tests< 1.14.12-1.module+el8.3.0+8784+380394dcgolang-tests-1.14.12-1.module+el8.3.0+8784+380394dc.noarch.rpm
RedHatanyppc64legolang< 1.14.12-1.module+el8.3.0+8784+380394dcgolang-1.14.12-1.module+el8.3.0+8784+380394dc.ppc64le.rpm
RedHatanyx86_64delve< 1.4.1-1.module+el8.3.0+7840+63dfb1eddelve-1.4.1-1.module+el8.3.0+7840+63dfb1ed.x86_64.rpm
RedHatanyaarch64golang-bin< 1.14.12-1.module+el8.3.0+8784+380394dcgolang-bin-1.14.12-1.module+el8.3.0+8784+380394dc.aarch64.rpm
RedHatanyx86_64delve-debuginfo< 1.4.1-1.module+el8.3.0+7840+63dfb1eddelve-debuginfo-1.4.1-1.module+el8.3.0+7840+63dfb1ed.x86_64.rpm
RedHatanyx86_64go-toolset< 1.14.12-1.module+el8.3.0+8784+380394dcgo-toolset-1.14.12-1.module+el8.3.0+8784+380394dc.x86_64.rpm
RedHatanys390xgolang-bin< 1.14.12-1.module+el8.3.0+8784+380394dcgolang-bin-1.14.12-1.module+el8.3.0+8784+380394dc.s390x.rpm
RedHatanynoarchgolang-src< 1.14.12-1.module+el8.3.0+8784+380394dcgolang-src-1.14.12-1.module+el8.3.0+8784+380394dc.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	ppc64le	go-toolset	< 1.14.12-1.module+el8.3.0+8784+380394dc	go-toolset-1.14.12-1.module+el8.3.0+8784+380394dc.ppc64le.rpm
RedHat	any	x86_64	golang-race	< 1.14.12-1.module+el8.3.0+8784+380394dc	golang-race-1.14.12-1.module+el8.3.0+8784+380394dc.x86_64.rpm
RedHat	any	noarch	golang-tests	< 1.14.12-1.module+el8.3.0+8784+380394dc	golang-tests-1.14.12-1.module+el8.3.0+8784+380394dc.noarch.rpm
RedHat	any	ppc64le	golang	< 1.14.12-1.module+el8.3.0+8784+380394dc	golang-1.14.12-1.module+el8.3.0+8784+380394dc.ppc64le.rpm
RedHat	any	x86_64	delve	< 1.4.1-1.module+el8.3.0+7840+63dfb1ed	delve-1.4.1-1.module+el8.3.0+7840+63dfb1ed.x86_64.rpm
RedHat	any	aarch64	golang-bin	< 1.14.12-1.module+el8.3.0+8784+380394dc	golang-bin-1.14.12-1.module+el8.3.0+8784+380394dc.aarch64.rpm
RedHat	any	x86_64	delve-debuginfo	< 1.4.1-1.module+el8.3.0+7840+63dfb1ed	delve-debuginfo-1.4.1-1.module+el8.3.0+7840+63dfb1ed.x86_64.rpm
RedHat	any	x86_64	go-toolset	< 1.14.12-1.module+el8.3.0+8784+380394dc	go-toolset-1.14.12-1.module+el8.3.0+8784+380394dc.x86_64.rpm
RedHat	any	s390x	golang-bin	< 1.14.12-1.module+el8.3.0+8784+380394dc	golang-bin-1.14.12-1.module+el8.3.0+8784+380394dc.s390x.rpm
RedHat	any	noarch	golang-src	< 1.14.12-1.module+el8.3.0+8784+380394dc	golang-src-1.14.12-1.module+el8.3.0+8784+380394dc.noarch.rpm