Skip to content
OpenAdvisories
Medium ELSA-2021-3076 4 CVEs

Moderate: go-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

Published Aug 12, 2021 · Updated Aug 12, 2021

Ecosystem: Oracle Linux

Summary

golang
[1.15.14-1]
- Rebase to go-1.15.14-1-openssl-fips
- Resolves: rhbz#1982287
- Addresses CVE-2021-34558

[1.15.13-4]
- Related: rhbz#1978567

go-toolset
[1.15.14-1]
- Rebase to go-1.15.14-1-openssl-fips
- Resolves: rhbz#1982287
- Addresses CVE-2021-34558

[1.15.13-2]
- Related: rhbz#1978567

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 8 delve 0:1.5.0-2.0.1.module+el8.4.0+20021+8a86d991
Oracle Linux · 8 go-toolset 0:1.15.14-1.module+el8.4.0+20290+7af514f4
Oracle Linux · 8 golang 0:1.15.14-1.module+el8.4.0+20290+7af514f4
Oracle Linux · 8 golang-bin 0:1.15.14-1.module+el8.4.0+20290+7af514f4
Oracle Linux · 8 golang-docs 0:1.15.14-1.module+el8.4.0+20290+7af514f4
Oracle Linux · 8 golang-misc 0:1.15.14-1.module+el8.4.0+20290+7af514f4
Oracle Linux · 8 golang-race 0:1.15.14-1.module+el8.4.0+20290+7af514f4
Oracle Linux · 8 golang-src 0:1.15.14-1.module+el8.4.0+20290+7af514f4
Oracle Linux · 8 golang-tests 0:1.15.14-1.module+el8.4.0+20290+7af514f4

Vulnerabilities 4

  • Medium 5.9
    CVE-2021-31525

    golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion

    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

    go stdlib k3d golang-1.16 Debian Ubuntu Alpine Wolfi Go
  • Unscored —
    CVE-2021-27918

    Infinite loop when decoding inputs in encoding/xml

    encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-33196

    Panic when reading certain archives in archive/zip

    In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-34558 Public exploit

    Panic on certain certificates in crypto/tls

    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go