Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | delve | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | delve-debuginfo | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | delve-debugsource | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | go-toolset | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-bin | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-docs | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-misc | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-race | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-src | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-tests | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
Vulnerabilities 4
-
Unscored —
Cross-site scripting in net/http/cgi and net/http/fcgi
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
-
Unscored —
Panic during division of very large numbers in math/big
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
-
Unscored —
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
-
Unscored —
Arbitrary code execution via the go command with cgo in cmd/go
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.14.10_toolset
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1874857
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1897635
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1897643
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1897646
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5493.json
-
report
https://access.redhat.com/security/cve/CVE-2020-24553
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-24553
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-24553
-
article
https://groups.google.com/forum/#!topic/golang-announce/8wqlSbkLdPs
-
article
https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-004/-inconsistent-behavior-of-gos-cgi-and-fastcgi-transport-may-lead-to-cross-site-scripting
-
report
https://access.redhat.com/security/cve/CVE-2020-28362
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-28362
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-28362
-
report
https://access.redhat.com/security/cve/CVE-2020-28366
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-28366
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-28366
-
article
https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ
-
report
https://access.redhat.com/security/cve/CVE-2020-28367
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-28367
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-28367