Summary
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
* golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)
* golang: cmd/go: Protocol Fallback when fetching modules (CVE-2023-45285)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | delve | 1.20.2-1.module_el8.9.0+3642+43318da8 |
| AlmaLinux · 8 | go-toolset | 1.20.12-1.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux · 8 | golang | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux · 8 | golang-bin | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux · 8 | golang-docs | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux · 8 | golang-misc | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux · 8 | golang-src | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux · 8 | golang-tests | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
Vulnerabilities 2
-
Unscored —
Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…
-
Unscored —
Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affec…