Skip to content
OpenAdvisories
Medium ALAS2-2020-1479 1 CVE

Moderate: golang security update (Amazon Linux 2)

Published Aug 18, 2020 · Updated Aug 24, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-15586: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. 1856953: CVE-2020-15586 golang: data race in certain net/http servers including ReverseProxy can lead to DoS

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 golang 0:1.13.14-1.amzn2.0.1
Amazon Linux · 2 golang-bin 0:1.13.14-1.amzn2.0.1
Amazon Linux · 2 golang-docs 0:1.13.14-1.amzn2.0.1
Amazon Linux · 2 golang-misc 0:1.13.14-1.amzn2.0.1
Amazon Linux · 2 golang-race 0:1.13.14-1.amzn2.0.1
Amazon Linux · 2 golang-src 0:1.13.14-1.amzn2.0.1
Amazon Linux · 2 golang-tests 0:1.13.14-1.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2020-15586

    Data race and crash in net/http

    Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-15586.html