Skip to content
OpenAdvisories
High ELSA-2022-17956 8 CVEs

Important: go-toolset:ol8addon security update (Oracle Linux 8)

Published Jul 12, 2022 · Updated Jul 12, 2022

Ecosystem: Oracle Linux

Summary

go-toolset
[1.18.3-1]
- Update to golang 1.18.3

golang
[1.18.3-1.0.1]
- Rebase to 1.18.3 by adding upstream patches to the 1.18.0 openssl-fips
- Modify Patch51852 to remove portions already upstream
- Use base_version to distinguish the version of the tarball from the
final version
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

[1.18.1-2.0.1]
- Rebase to 1.18.0 openssl-fips
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

[1.17.10-1.0.1]
- Add patches between Go 1.17.7 and Go 1.17.10
- Rename base_versn to base_version
- Remove unneeded patches from previous version
- Remove Patch2028662 because that patch is also upstream now
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

delve
[1.8.3-1.0.1]
- Bump version of delve from 1.7.2 to 1.8.3

[1.7.2-1.0.1]
- Bump version of delve from 1.6.0 to 1.7.2, enable aarch64

[1.6.0-1.0.1]
- Bump upstream version of delve from 1.5.0 to 1.6.0

[1.5.0-2.0.1]
- Cherry pick 05508ea98055bcb5418d2dc83893af4eb044d151:
+ Disable DWARF compression which has issues (Alex Burmashev)
+ By David Sloboda <david.x.sloboda@oracle.com>

[1.5.0-2]
- Add golang-1.15.4 related patch
- Resolves: rhbz#1901189

[1.5.0-1]
- Rebase to 1.5.0
- Related: rhbz#1870531

[1.4.1-1]
- Rebase to 1.4.1
- Resolves: rhbz#1821281
- Related: rhbz#1820596

[1.4.0-2]
- Change i686 to a better macro
- Related: rhbz#1820596

[1.4.0-1]
- Rebase to 1.4.0
- Remove Patch1781
- Related: rhbz#1820596

[1.3.2-3]
- Resolves: rhbz#1758612
- Resolves: rhbz#1780554
- Add patch: 1781-pkg-terminal-Fix-exit-status.patch

[1.3.2-2]
- Added tests
- Related: rhbz#1758612

[1.3.2-1]
- First package for RHEL
- Related: rhbz#1758612

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 8 delve 0:1.8.3-1.0.1.module+el8.6.0+20704+139a7dad
Oracle Linux · 8 go-toolset 0:1.18.3-1.module+el8.6.0+20704+139a7dad
Oracle Linux · 8 golang 0:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
Oracle Linux · 8 golang-bin 0:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
Oracle Linux · 8 golang-docs 0:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
Oracle Linux · 8 golang-misc 0:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
Oracle Linux · 8 golang-race 0:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
Oracle Linux · 8 golang-src 0:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
Oracle Linux · 8 golang-tests 0:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad

Vulnerabilities 8

  • High 7.8
    CVE-2022-30580

    Empty Cmd.Path can trigger unintended binary in os/exec on Windows

    Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

    Go standard library os/exec golang go Azure Linux Alpine Go
  • Medium 5.3
    CVE-2022-29526

    golang.org/x/sys/unix has Incorrect privilege reporting in syscall

    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

    golang stdlib k3d golang-1.8 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Low 3.1
    CVE-2022-30629

    Session tickets lack random ticket_age_add in crypto/tls

    Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-24675 Public exploit

    Stack overflow from a large amount of PEM data in encoding/pem

    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-27536

    Panic during certificate parsing on Darwin in crypto/x509

    Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

    golang go stdlib Azure Linux Alpine Go
  • Unscored —
    CVE-2022-28327

    Panic due to large inputs affecting P-256 curves in crypto/elliptic

    The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-29804

    Path traversal via Clean on Windows in path/filepath

    Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

    Go standard library path/filepath golang go Azure Linux Alpine Go
  • Unscored —
    CVE-2022-30634

    Indefinite hang with large buffers on Windows in crypto/rand

    Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

    Go standard library crypto/rand golang go Ubuntu Azure Linux Alpine Go