Summary
delve
[1.20.2-1.0.1]
- Disable DWARF compression which has issues (Alex Burmashev)
[1.20.2-1]
- Rebase to 1.20.2
- Resolves: rhbz#2186495
golang
[1.20.12-1]
- Update to Go 1.20.12
- Fix CVE-2023-39326 CVE-2023-45285
go-toolset
[1.20.12-1]
- Update to Go 1.20.12
- CVE-2023-39326 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP request (rhbz 2253330)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | delve | 0:1.20.2-1.0.1.module+el8.9.0+90001+52c302fe |
| Oracle Linux · 8 | go-toolset | 0:1.20.12-1.module+el8.9.0+90156+2bd6b1a8 |
| Oracle Linux · 8 | golang | 0:1.20.12-1.module+el8.9.0+90156+2bd6b1a8 |
| Oracle Linux · 8 | golang-bin | 0:1.20.12-1.module+el8.9.0+90156+2bd6b1a8 |
| Oracle Linux · 8 | golang-docs | 0:1.20.12-1.module+el8.9.0+90156+2bd6b1a8 |
| Oracle Linux · 8 | golang-misc | 0:1.20.12-1.module+el8.9.0+90156+2bd6b1a8 |
| Oracle Linux · 8 | golang-src | 0:1.20.12-1.module+el8.9.0+90156+2bd6b1a8 |
| Oracle Linux · 8 | golang-tests | 0:1.20.12-1.module+el8.9.0+90156+2bd6b1a8 |
Vulnerabilities 2
-
Unscored —
Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…
-
Unscored —
Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affec…