Summary
[1.20.12-1]
- Rebase to 1.20.12
- Fix CVE-2023-45285 CVE-2023-39326
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | go-toolset | 0:1.20.12-1.el9_3 |
| Oracle Linux · 9 | golang | 0:1.20.12-1.el9_3 |
| Oracle Linux · 9 | golang-bin | 0:1.20.12-1.el9_3 |
| Oracle Linux · 9 | golang-docs | 0:1.20.12-1.el9_3 |
| Oracle Linux · 9 | golang-misc | 0:1.20.12-1.el9_3 |
| Oracle Linux · 9 | golang-src | 0:1.20.12-1.el9_3 |
| Oracle Linux · 9 | golang-tests | 0:1.20.12-1.el9_3 |
Vulnerabilities 2
-
Unscored —
Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…
-
Unscored —
Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affec…