Summary
golang
[1.19.13-1]
- Update to go 1.19.13
[CVE-2023-44487]
[CVE-2023-39325]
[CVE-2023-29409]
go-toolset
[1.19.13-1]
- Update to Go version 1.19.13
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | go-toolset | 0:1.19.13-1.el9_2 |
| Oracle Linux · 9 | golang | 0:1.19.13-1.el9_2 |
| Oracle Linux · 9 | golang-bin | 0:1.19.13-1.el9_2 |
| Oracle Linux · 9 | golang-docs | 0:1.19.13-1.el9_2 |
| Oracle Linux · 9 | golang-misc | 0:1.19.13-1.el9_2 |
| Oracle Linux · 9 | golang-race | 0:1.19.13-1.el9_2 |
| Oracle Linux · 9 | golang-src | 0:1.19.13-1.el9_2 |
| Oracle Linux · 9 | golang-tests | 0:1.19.13-1.el9_2 |
Vulnerabilities 3
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
High 7.5CVE-2023-39325 Public exploit
HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…
-
Unscored —CVE-2023-29409 Public exploit
Large RSA keys can cause high CPU usage in crypto/tls
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…