Skip to content
OpenAdvisories
Unscored RHSA-2020:0329 2 CVEs

Red Hat Security Advisory: go-toolset:rhel8 security update

Published Sep 18, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream go-toolset 0:1.12.12-2.module+el8.1.0+5317+8a49ffbb
Red Hat · RHEL 8 enterprise_linux:8::appstream golang 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-bin 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-docs 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-misc 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-race 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-src 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-tests 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb

Vulnerabilities 2

  • Unscored —
    CVE-2019-16276

    Request smuggling due to accepting invalid headers in net/http via net/textproto

    Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

    go stdlib golang-1.8 golang-1.10 Ubuntu Alpine Go
  • Unscored —
    CVE-2019-17596 Public exploit

    Panic on invalid DSA public keys in crypto/dsa

    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

    golang go stdlib golang-1.8 Ubuntu Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1755969
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1763310
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0329.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-16276
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16276
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16276
  • article
    https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ
  • report
    https://access.redhat.com/security/cve/CVE-2019-17596
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-17596
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-17596
  • article
    https://groups.google.com/forum/#!msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ