Skip to content
OpenAdvisories
Unscored RHSA-2020:0101 2 CVEs

Red Hat Security Advisory: go-toolset-1.12-golang security update

Published Sep 18, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-build 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-golang 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-golang-bin 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-golang-docs 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-golang-misc 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-golang-race 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-golang-src 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-golang-tests 0:1.12.12-4.el7
Red Hat · Devtools 2019 devtools:2019 go-toolset-1.12-runtime 0:1.12.12-4.el7

Vulnerabilities 2

  • Unscored —
    CVE-2019-16276

    Request smuggling due to accepting invalid headers in net/http via net/textproto

    Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

    go stdlib golang-1.8 golang-1.10 Ubuntu Alpine Go
  • Unscored —
    CVE-2019-17596 Public exploit

    Panic on invalid DSA public keys in crypto/dsa

    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

    go golang stdlib golang-1.8 Ubuntu Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1755969
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1763310
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0101.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-16276
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16276
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16276
  • article
    https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ
  • report
    https://access.redhat.com/security/cve/CVE-2019-17596
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-17596
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-17596
  • article
    https://groups.google.com/forum/#!msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ