Skip to content
OpenAdvisories
High ELSA-2021-5160 2 CVEs

Important: go-toolset:ol8 security and bug fix update (Oracle Linux 8)

Published Dec 16, 2021 · Updated Dec 16, 2021

Ecosystem: Oracle Linux

Summary

golang
[1.16.12-1]
- Rebase to Go 1.16.12
- Resolves: rhbz#2031125

go-toolset
[1.16.12-1]
- Rebase to Go 1.16.12
- Resolves: rhbz#2031125

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 8 delve 0:1.6.0-1.0.1.module+el8.5.0+20332+2a8a7cc5
Oracle Linux · 8 go-toolset 0:1.16.12-1.module+el8.5.0+20456+eee863d9
Oracle Linux · 8 golang 0:1.16.12-1.module+el8.5.0+20456+eee863d9
Oracle Linux · 8 golang-bin 0:1.16.12-1.module+el8.5.0+20456+eee863d9
Oracle Linux · 8 golang-docs 0:1.16.12-1.module+el8.5.0+20456+eee863d9
Oracle Linux · 8 golang-misc 0:1.16.12-1.module+el8.5.0+20456+eee863d9
Oracle Linux · 8 golang-race 0:1.16.12-1.module+el8.5.0+20456+eee863d9
Oracle Linux · 8 golang-src 0:1.16.12-1.module+el8.5.0+20456+eee863d9
Oracle Linux · 8 golang-tests 0:1.16.12-1.module+el8.5.0+20456+eee863d9

Vulnerabilities 2

  • High 7.5
    CVE-2021-44716

    golang.org/x/net/http2 allows uncontrolled memory consumption

    net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-44717

    Misdirected I/O in syscall

    Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

    go stdlib golang-1.8 golang-1.17 Debian Ubuntu Alpine Go