Skip to content
OpenAdvisories
Unscored RHSA-2022:1819 7 CVEs

Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update

Published Oct 21, 2024 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream delve 0:1.7.2-1.module+el8.6.0+12972+ebab5911
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debuginfo 0:1.7.2-1.module+el8.6.0+12972+ebab5911
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debugsource 0:1.7.2-1.module+el8.6.0+12972+ebab5911
Red Hat · RHEL 8 enterprise_linux:8::appstream go-toolset 0:1.17.7-1.module+el8.6.0+14297+32a15e19
Red Hat · RHEL 8 enterprise_linux:8::appstream golang 0:1.17.7-1.module+el8.6.0+14297+32a15e19
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-bin 0:1.17.7-1.module+el8.6.0+14297+32a15e19
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-docs 0:1.17.7-1.module+el8.6.0+14297+32a15e19
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-misc 0:1.17.7-1.module+el8.6.0+14297+32a15e19
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-race 0:1.17.7-1.module+el8.6.0+14297+32a15e19
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-src 0:1.17.7-1.module+el8.6.0+14297+32a15e19
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-tests 0:1.17.7-1.module+el8.6.0+14297+32a15e19

Vulnerabilities 7

  • Unscored —
    CVE-2021-38297 Public exploit EPSS 11%

    Buffer overflow in WASM modules in misc/wasm and cmd/link

    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

    golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-39293

    Panic due to crafted inputs in archive/zip

    In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

    go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2021-41771

    Panic on invalid symbol tables in debug/macho

    ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-41772

    Panic when opening certain archives in archive/zip

    Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

    golang go stdlib golang-1.8 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23772

    Uncontrolled memory consumption in math/big

    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23773 Public exploit

    Incorrect access control in the go command in cmd/go/internal/modfetch

    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

    golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23806

    Incorrect computation for some invalid field elements in crypto/elliptic

    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

    golang go stdlib lxd Debian Ubuntu Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2006044
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2012887
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2014704
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2020725
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2020736
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053429
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053532
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053541
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1819.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-38297
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-38297
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-38297
  • article
    https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A
  • report
    https://access.redhat.com/security/cve/CVE-2021-39293
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-39293
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-39293
  • article
    https://groups.google.com/g/golang-announce/c/dx9d7IOseHw
  • report
    https://access.redhat.com/security/cve/CVE-2021-41771
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-41771
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-41771
  • article
    https://groups.google.com/g/golang-announce/c/0fM21h43arc
  • report
    https://access.redhat.com/security/cve/CVE-2021-41772
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-41772
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-41772
  • report
    https://access.redhat.com/security/cve/CVE-2022-23772
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-23772
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-23772
  • article
    https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
  • report
    https://access.redhat.com/security/cve/CVE-2022-23773
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-23773
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-23773
  • report
    https://access.redhat.com/security/cve/CVE-2022-23806
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-23806
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-23806