Moderate: go-toolset and golang security and bug fix update (Oracle Linux 9)

Summary

Fixed packages 8

Vulnerabilities 3

• Unscored —
  CVE-2022-2879

  Unbounded memory consumption when reading headers in archive/tar

  Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

  Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-2880

  Incorrect sanitization of forwarded query parameters in net/http/httputil

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

  Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-41715

  Memory exhaustion when compiling regular expressions in regexp/syntax

  Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

  Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022