Skip to content
OpenAdvisories
Medium ALSA-2022:1819 8 CVEs

Moderate: go-toolset:rhel8 security and bug fix update

Published May 10, 2022 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: Command-line arguments may overwrite global data (CVE-2021-38297)

* golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)

* golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

* golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

* golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)

* golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

* golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 9

ReleasePackageFixed in
AlmaLinux · 8 delve 1.7.2-1.module_el8.6.0+2736+ec10aba8
AlmaLinux · 8 go-toolset 1.17.7-1.module_el8.6.0+2736+ec10aba8
AlmaLinux · 8 golang 1.17.7-1.module_el8.6.0+2736+ec10aba8
AlmaLinux · 8 golang-bin 1.17.7-1.module_el8.6.0+2736+ec10aba8
AlmaLinux · 8 golang-docs 1.17.7-1.module_el8.6.0+2736+ec10aba8
AlmaLinux · 8 golang-misc 1.17.7-1.module_el8.6.0+2736+ec10aba8
AlmaLinux · 8 golang-race 1.17.7-1.module_el8.6.0+2736+ec10aba8
AlmaLinux · 8 golang-src 1.17.7-1.module_el8.6.0+2736+ec10aba8
AlmaLinux · 8 golang-tests 1.17.7-1.module_el8.6.0+2736+ec10aba8

Vulnerabilities 8

  • Unscored —
    CVE-2021-33196

    Panic when reading certain archives in archive/zip

    In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-38297 Public exploit EPSS 11%

    Buffer overflow in WASM modules in misc/wasm and cmd/link

    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

    golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-39293

    Panic due to crafted inputs in archive/zip

    In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

    go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2021-41771

    Panic on invalid symbol tables in debug/macho

    ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-41772

    Panic when opening certain archives in archive/zip

    Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

    golang go stdlib golang-1.8 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23772

    Uncontrolled memory consumption in math/big

    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23773 Public exploit

    Incorrect access control in the go command in cmd/go/internal/modfetch

    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

    golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23806

    Incorrect computation for some invalid field elements in crypto/elliptic

    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

    golang go stdlib lxd Debian Ubuntu Azure Linux Alpine Go

References

  • report
    https://vulners.com/cve/CVE-2021-38297
  • report
    https://vulners.com/cve/CVE-2021-39293
  • report
    https://vulners.com/cve/CVE-2021-41771
  • report
    https://vulners.com/cve/CVE-2021-41772
  • report
    https://vulners.com/cve/CVE-2022-23772
  • report
    https://vulners.com/cve/CVE-2022-23773
  • report
    https://vulners.com/cve/CVE-2022-23806