Summary
delve
[1.9.1-1.0.1]
- Bump version of delve from 1.8.3 to 1.9.1
[1.8.3-1.0.1]
- Bump version of delve from 1.7.2 to 1.8.3
[1.7.2-1.0.1]
- Bump version of delve from 1.6.0 to 1.7.2, enable aarch64
[1.6.0-1.0.1]
- Bump upstream version of delve from 1.5.0 to 1.6.0
[1.5.0-2.0.1]
- Cherry pick 05508ea98055bcb5418d2dc83893af4eb044d151:
+ Disable DWARF compression which has issues (Alex Burmashev)
+ By David Sloboda <david.x.sloboda@oracle.com>
[1.5.0-2]
- Add golang-1.15.4 related patch
- Resolves: rhbz#1901189
[1.5.0-1]
- Rebase to 1.5.0
- Related: rhbz#1870531
[1.4.1-1]
- Rebase to 1.4.1
- Resolves: rhbz#1821281
- Related: rhbz#1820596
[1.4.0-2]
- Change i686 to a better macro
- Related: rhbz#1820596
[1.4.0-1]
- Rebase to 1.4.0
- Remove Patch1781
- Related: rhbz#1820596
[1.3.2-3]
- Resolves: rhbz#1758612
- Resolves: rhbz#1780554
- Add patch: 1781-pkg-terminal-Fix-exit-status.patch
[1.3.2-2]
- Added tests
- Related: rhbz#1758612
[1.3.2-1]
- First package for RHEL
- Related: rhbz#1758612
golang
[1.19.4-2.0.1]
- Rebase to 1.19.4 openssl-fips
- Removed patches:
Patch215: go1.5-zoneinfo_testing_only.patch (upstream commit 946587811423)
Patch226: disable_static_external_tests.patch (included in new patches)
Patch51852: disable-crypto-x509-test.patch (no longer needed)
- Added patches:
Patch0001: disable_static_tests_part1.patch (part of old patch 226)
Patch0002: disable_static_tests_part2.patch (part of old patch 226)
Patch0003: fix-test-1024-leaf-certs.patch (fixes change in openssl-fips patches)
Patch0004: fix-memory-leak-evp-sign-verify.patch (fixes openssl-fips patches)
- Remove disabling of ED25519 test, it is done in the openssl-fips patches
- Remove use of extra source for binary file patching
- Remove AUTHORS and CONTRIBUTORS from doc section, they were removed upstream,
in golang issue 53961
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
[1.19.4-2]
- Fix memory leaks in EVP_{sign,verify}_raw
- Resolves: rhbz#2132767
[1.19.4-1]
- Rebase to Go 1.19.4
- Fix ppc64le linker issue
- Remove defunct patches
- Remove downstream generated FIPS mode patches
- Add golang-fips/go as the source for FIPS mode patches
- Resolves: rhbz#2144542
[1.18.8-1.0.1]
- Rebase to 1.18.8 by adding upstream patches to the 1.18.0 openssl-fips
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
[1.19.2-4]
- Enable big endian support in FIPS mode
- Resolves: rhbz#1969844
[1.19.2-3]
- Restore old HashSign/HashVerify API
- Resolves: rhbz#2132730
[1.19.2-2]
- Add support for 4096 bit keys in x509
- Resolves: rhbz#2132694
[1.19.2-1]
- Rebase to Go 1.19.2
- Resolves: rhbz#2132730
[1.19.1-2]
- Rebase to Go 1.19.1
- Resolves: rhbz#2131026
[1.18.3-1.0.1]
- Rebase to 1.18.3 by adding upstream patches to the 1.18.0 openssl-fips
- Modify Patch51852 to remove portions already upstream
- Use base_version to distinguish the version of the tarball from the
final version
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
[1.18.1-2.0.1]
- Rebase to 1.18.0 openssl-fips
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
[1.17.10-1.0.1]
- Add patches between Go 1.17.7 and Go 1.17.10
- Rename base_versn to base_version
- Remove unneeded patches from previous version
- Remove Patch2028662 because that patch is also upstream now
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
[1.18.0-2]
- Enable SHA1 in some contexts
- Related: rhbz#2075162
[1.18.0-1]
- Update Go to 1.18.0
- Resolves: rhbz#2075162
[1.17.7-1]
- Rebase to Go 1.17.7
- Remove fips memory leak patch (fixed in tree)
- Resolves: rhbz#2015930
[1.17.5-1.0.1]
- Rebase to 1.17.2 fips. Update to 1.17.5.
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
[1.17.5-1]
- Rebase to Go 1.17.5
- Remove vdso_s390x_gettime patch
- Resolves: rhbz#2031112
- Related: rhbz#2028570
[1.17.4-1]
- Rebase Go to 1.17.4
- Add remove_waitgroup_misuse_tests patch
- Related: rhbz#2014088
- Resolves: rhbz#2028570
- Resolves: rhbz#2022828
- Resolves: rhbz#2024686
- Resolves: rhbz#2028662
[1.17.2-2]
- Resolves: rhbz#2014704
[1.17.2-1]
- Rebase to Go 1.17.2
- Related: rhbz#2014088
- Remove golang-1.15-warnCN.patch
- Remove reject-leading-zeros.patch
- Remove favicon.ico and robots.txt references
- Exclude TestEd25519Vectors test
[1.16.9-1.0.1]
- Rebase to 1.16.7 fips, and add patches to bring up to 1.16.9
[1.16.7-1]
- Rebase to Go 1.16.7
- Resolves: rhbz#1994079
- Add reject leading zeros patch
- Resolves: rhbz#1993314
[1.16.6-2]
- Fix TestBoringServerCurves failure when run by itself
- Resolves: rhbz#1976168
[1.16.6-1]
- Rebase to go-1.16.6-1-openssl-fips
- Resolves: rhbz#1982281
- Addresses CVE-2021-34558
[1.16.5-1]
- Rebase to 1.16.5
- Removes rhbz#1955032 patch, it's already included in this release
- Removes rhbz#1956891 patch, it's already included in this release
- Related: rhbz#1979677
- Related: rhbz#1968738
- Related: rhbz#1972420
[1.16.4-3]
- Fix zero-size allocation memory leak.
- Related: rhbz#1951877
[1.16.4-2]
- Resolves: rhbz#1951877
[1.16.4-1]
- Rebase to go-1.16.4-1-openssl-fips
[1.16.1-3]
- Resolves: rhbz#1956891
[1.16.1-2]
- Resolves: rhbz#1955032
[1.16.1-1]
- Rebase to go-1.16.1-2-openssl-fips
- Resolves: rhbz#1938071
- Adds a workaround for rhbz#1939923
- Removes Patch224, it's on upstream -> rhbz#1888673
- Removes Patch225, it's on upstream -> https://go-review.googlesource.com/c/text/+/238238
- Removes old patches for cleaning purposes
[1.15.10-1]
- Use patches to update version 1.15.7 to 1.15.10
[1.15.7-1]
- Rebase to 1.15.7
- Resolves: rhbz#1870531
- Resolves: rhbz#1919261
[1.15.5-1]
- Rebase to 1.15.5
- Resolves: rhbz#1898652
- Resolves: rhbz#1898660
- Resolves: rhbz#1898649
[1.15.3-2]
- fix typo in patch file name
- Related: rhbz#1881539
[1.15.3-1]
- Rebase to 1.15.3
- fix x/text infinite loop
- Resolves: rhbz#1881539
[1.15.2-2]
- Resolves: rhbz#1850045
[1.15.2-1]
- Rebase to 1.15.2
- fix rhbz#1872622 in commit af9a1b1f6567a1c5273a134d395bfe7bb840b7f8
- Resolves: rhbz#18726
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | delve | 0:1.9.1-1.0.1.module+el8.7.0+20922+47ac84ba |
| Oracle Linux · 8 | go-toolset | 0:1.19.4-1.module+el8.7.0+20922+47ac84ba |
| Oracle Linux · 8 | golang | 0:1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba |
| Oracle Linux · 8 | golang-bin | 0:1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba |
| Oracle Linux · 8 | golang-docs | 0:1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba |
| Oracle Linux · 8 | golang-misc | 0:1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba |
| Oracle Linux · 8 | golang-race | 0:1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba |
| Oracle Linux · 8 | golang-src | 0:1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba |
| Oracle Linux · 8 | golang-tests | 0:1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba |
Vulnerabilities 8
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
-
High 7.5
Restricted file access on Windows in os and net/http
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, …
-
Medium 6.3
Unsanitized NUL in environment variables on Windows in syscall and os/exec
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment …
-
Medium 5.3CVE-2022-41717 Public exploit
Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…
-
Unscored —
Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …
-
Unscored —
Incorrect sanitization of forwarded query parameters in net/http/httputil
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…
-
Unscored —
Failure to strip relative path components in net/url
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from …
-
Unscored —
Memory exhaustion when compiling regular expressions in regexp/syntax
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…