[SECURITY] [DLA 3395-1] golang-1.11 security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3395-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Sylvain Beucler
April 19, 2023 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : golang-1.11
Version : 1.11.6-1+deb10u6
CVE ID : CVE-2020-28367 CVE-2021-33196 CVE-2021-36221 CVE-2021-38297
CVE-2021-39293 CVE-2021-41771 CVE-2021-44716 CVE-2021-44717
CVE-2022-23806 CVE-2022-24921
Debian Bug : 989492 991961
Multiple vulnerabilities were discovered in the Go programming
language. An attacker could trigger a denial-of-service (DoS), invalid
cryptographic computation, information leak, or arbitrary code
execution on the developer's computer in specific situations.
CVE-2020-28367
Code injection in the go command with cgo allows arbitrary code
execution at build time via malicious gcc flags specified via a
#cgo directive.
CVE-2021-33196
In archive/zip, a crafted file count (in an archive's header) can
cause a NewReader or OpenReader panic.
CVE-2021-36221
Go has a race condition that can lead to a net/http/httputil
ReverseProxy panic upon an ErrAbortHandler abort.
CVE-2021-38297
Go has a Buffer Overflow via large arguments in a function
invocation from a WASM module, when GOARCH=wasm GOOS=js is used.
CVE-2021-39293
This issue exists because of an incomplete fix for CVE-2021-33196.
CVE-2021-41771
ImportedSymbols in debug/macho (for Open or OpenFat) Accesses a
Memory Location After the End of a Buffer, aka an out-of-bounds
slice situation.
CVE-2021-44716
net/http allows uncontrolled memory consumption in the header
canonicalization cache via HTTP/2 requests.
CVE-2021-44717
Go on UNIX allows write operations to an unintended file or
unintended network connection as a consequence of erroneous
closing of file descriptor 0 after file-descriptor exhaustion.
CVE-2022-23806
Curve.IsOnCurve in crypto/elliptic can incorrectly return true in
situations with a big.Int value that is not a valid field element.
CVE-2022-24921
regexp.Compile allows stack exhaustion via a deeply nested
expression.
For Debian 10 buster, these problems have been fixed in version
1.11.6-1+deb10u6.
We recommend that you upgrade your golang-1.11 packages.
For the detailed security status of golang-1.11 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.11
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmRAX94ACgkQDTl9HeUl
XjAipQ//fPuoqFbeRqttwpVunHFwWGmuYy6W37nfJE0Sd1tAIRROgkTJY+inEQmK
xQ3GM/DYjwovQWqIANp4u18uhKyWnDySkSXFWIYJmVzxVKH4eLxh6kI7zqVXWToS
31GxVhPBz4/8xDOjK6Jnep8UidL+tZTeM8CHWYQ0ljPI1IQ/5seG1tBdnhJOKdNt
eoAzlB9szWza8Mf9pomhDV86EZ3YxCYnNMFYSRVlrInvicI+kGu4/W+5OEUL5fzW
cU/oH/rnXry2UxPFr2SndqJmyqEhDrbhlX/2xAA78RcZjK2V/yy4e2ZtPkM85U6/
kJDI+VZTgge5Rfjc6uL0UPmRhNutQpCUun22RP6kg44X2Oj+CrsZ9tGa5KFLX3V/
9GCIEmWeb47gaFaR23pS/Q2ENHSoLF0zdd+rgaY4ReNd4wpPSf5kfaYZOjimjaSo
xG64pLjDk5givMPwKRT5oZ+hN4czA9iogJFJ4RP3K725VQ1hSXqm2nlGHJlQO8mT
AGcxS4YyR8v2Cgxe2dCur4Lke0qcPZfW2q1mSo0CLq0+frirc4Vdf2tI6T28C7Kb
rnwugEMHSkWBGmF3bGD8dzFXQdVvaZZkVnpBUtl6pOaRpXKDIz2RqCWtJhv9lRi4
Dl4YFoXadRGJtbSHn8iyXey6Bf/V9H4fKJGTJpW/KyGgFPxEwxE=
=7U79
-----END PGP SIGNATURE-----
Reply to: