Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3115: Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download). 1918761: CVE-2021-3115 golang: cmd/go: packages using cgo can cause arbitrary code execution at build time CVE-2021-3114: In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field. 1918750: CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.15.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-bin | 0:1.15.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-docs | 0:1.15.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-misc | 0:1.15.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-race | 0:1.15.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-src | 0:1.15.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-tests | 0:1.15.8-1.amzn2.0.1 |
Vulnerabilities 2
-
Unscored —
Incorrect operations on the P-224 curve in crypto/elliptic
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
-
Unscored —
Arbitrary code injection via the go command with cgo on Windows in cmd/go
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).