Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-28367: Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. 1897646: CVE-2020-28367 golang: improper validation of cgo flags can lead to code execution at build time CVE-2020-28366: Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. 1897643: CVE-2020-28366 golang: malicious symbol names can lead to code execution at build time CVE-2020-28362: Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. 1897635: CVE-2020-28362 golang: math/big: panic during recursive division of very large numbers
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.15.5-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-bin | 0:1.15.5-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-docs | 0:1.15.5-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-misc | 0:1.15.5-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-race | 0:1.15.5-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-src | 0:1.15.5-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-tests | 0:1.15.5-1.amzn2.0.2 |
Vulnerabilities 3
-
Unscored —
Panic during division of very large numbers in math/big
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
-
Unscored —
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
-
Unscored —
Arbitrary code execution via the go command with cgo in cmd/go
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.