Summary
golang
[1.19.10-1.0.1]
- New Go version 1.19.10
[CVE-2023-29402]
[CVE-2023-29403]
[CVE-2023-29404]
[CVE-2023-29405]
go-toolset
[1.19.10-1.0.1]
- New Go version 1.19.10
[CVE-2023-29402]
[CVE-2023-29403]
[CVE-2023-29404]
[CVE-2023-29405]
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | go-toolset | 0:1.19.10-1.0.1.el9_2 |
| Oracle Linux · 9 | golang | 0:1.19.10-1.0.1.el9_2 |
| Oracle Linux · 9 | golang-bin | 0:1.19.10-1.0.1.el9_2 |
| Oracle Linux · 9 | golang-docs | 0:1.19.10-1.0.1.el9_2 |
| Oracle Linux · 9 | golang-misc | 0:1.19.10-1.0.1.el9_2 |
| Oracle Linux · 9 | golang-race | 0:1.19.10-1.0.1.el9_2 |
| Oracle Linux · 9 | golang-src | 0:1.19.10-1.0.1.el9_2 |
| Oracle Linux · 9 | golang-tests | 0:1.19.10-1.0.1.el9_2 |
Vulnerabilities 4
-
Critical 9.8
Code injection via go command with cgo in cmd/go
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in th…
-
Critical 9.8
Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo …
-
Critical 9.8
Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo …
-
High 7.8
Unsafe behavior in setuid/setgid binaries in runtime
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/set…