Summary
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
The golang packages provide the Go programming language compiler.
Security Fix(es):
* golang: net/http, x/net/http2: rapid stream resets can cause excessive work [CVE-2023-44487] (CVE-2023-39325)
* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
* golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* Midstream dist-git patches (BZ#2223637)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | go-toolset | 1.19.13-1.el9_2 |
| AlmaLinux · 9 | golang | 1.19.13-1.el9_2 |
| AlmaLinux · 9 | golang-bin | 1.19.13-1.el9_2 |
| AlmaLinux · 9 | golang-docs | 1.19.13-1.el9_2 |
| AlmaLinux · 9 | golang-misc | 1.19.13-1.el9_2 |
| AlmaLinux · 9 | golang-race | 1.19.13-1.el9_2 |
| AlmaLinux · 9 | golang-src | 1.19.13-1.el9_2 |
| AlmaLinux · 9 | golang-tests | 1.19.13-1.el9_2 |
Vulnerabilities 3
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
High 7.5CVE-2023-39325 Public exploit
HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…
-
Unscored —CVE-2023-29409 Public exploit
Large RSA keys can cause high CPU usage in crypto/tls
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-29409
-
report
https://access.redhat.com/security/cve/CVE-2023-39325
-
report
https://access.redhat.com/security/cve/CVE-2023-44487
-
report
https://bugzilla.redhat.com/2228743
-
report
https://bugzilla.redhat.com/2242803
-
report
https://bugzilla.redhat.com/2243296
-
advisory
https://errata.almalinux.org/9/ALSA-2023-5738.html