Summary
delve
[1.7.2-1.0.1]
- Disable DWARF compression which has issues (Alex Burmashev)
[1.7.2-1]
- Rebase to 1.7.2
- Related: rhbz#2014088
golang
[1.17.7-1]
- Rebase to Go 1.17.7
- Remove fips memory leak patch (fixed in tree)
- Resolves: rhbz#2015930
go-toolset
[1.17.7-1]
- Rebase to Go 1.17.7
- Remove fips memory leak patch (fixed in tree)
- Resolves: rhbz#2015930
[1.17.5-1]
- Rebase to Go 1.17.5
- Resolves: rhbz#2031112
[1.17.4-1]
- Rebase Go to 1.17.4
- Add vdso_s390x_gettime patch
- Add remove_waitgroup_misuse_tests patch
- Related: rhbz#2014088
- Resolves: rhbz#2028570
- Resolves: rhbz#2022828
- Resolves: rhbz#2024686
- Resolves: rhbz#2028662
[1.17.2-1]
- Rebase to Go 1.17.2
- Rebase to Delve 1.7.2
- Resolves: rhbz#2014088
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | delve | 0:1.7.2-1.0.1.module+el8.6.0+20559+3b94dc2a |
| Oracle Linux · 8 | go-toolset | 0:1.17.7-1.module+el8.6.0+20559+3b94dc2a |
| Oracle Linux · 8 | golang | 0:1.17.7-1.module+el8.6.0+20559+3b94dc2a |
| Oracle Linux · 8 | golang-bin | 0:1.17.7-1.module+el8.6.0+20559+3b94dc2a |
| Oracle Linux · 8 | golang-docs | 0:1.17.7-1.module+el8.6.0+20559+3b94dc2a |
| Oracle Linux · 8 | golang-misc | 0:1.17.7-1.module+el8.6.0+20559+3b94dc2a |
| Oracle Linux · 8 | golang-race | 0:1.17.7-1.module+el8.6.0+20559+3b94dc2a |
| Oracle Linux · 8 | golang-src | 0:1.17.7-1.module+el8.6.0+20559+3b94dc2a |
| Oracle Linux · 8 | golang-tests | 0:1.17.7-1.module+el8.6.0+20559+3b94dc2a |
Vulnerabilities 7
-
Unscored —
Buffer overflow in WASM modules in misc/wasm and cmd/link
Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.
-
Unscored —
Panic due to crafted inputs in archive/zip
In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.
-
Unscored —
Panic on invalid symbol tables in debug/macho
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
-
Unscored —
Panic when opening certain archives in archive/zip
Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.
-
Unscored —
Uncontrolled memory consumption in math/big
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
-
Unscored —CVE-2022-23773 Public exploit
Incorrect access control in the go command in cmd/go/internal/modfetch
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
-
Unscored —
Incorrect computation for some invalid field elements in crypto/elliptic
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.