RHSA-2022:5775 — Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update

Fixed packages 11

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	delve	0:1.7.2-1.module+el8.6.0+12972+ebab5911
Red Hat · RHEL 8 enterprise_linux:8::appstream	delve-debuginfo	0:1.7.2-1.module+el8.6.0+12972+ebab5911
Red Hat · RHEL 8 enterprise_linux:8::appstream	delve-debugsource	0:1.7.2-1.module+el8.6.0+12972+ebab5911
Red Hat · RHEL 8 enterprise_linux:8::appstream	go-toolset	0:1.17.12-1.module+el8.6.0+16014+a372c00b
Red Hat · RHEL 8 enterprise_linux:8::appstream	golang	0:1.17.12-1.module+el8.6.0+16014+a372c00b
Red Hat · RHEL 8 enterprise_linux:8::appstream	golang-bin	0:1.17.12-1.module+el8.6.0+16014+a372c00b
Red Hat · RHEL 8 enterprise_linux:8::appstream	golang-docs	0:1.17.12-1.module+el8.6.0+16014+a372c00b
Red Hat · RHEL 8 enterprise_linux:8::appstream	golang-misc	0:1.17.12-1.module+el8.6.0+16014+a372c00b
Red Hat · RHEL 8 enterprise_linux:8::appstream	golang-race	0:1.17.12-1.module+el8.6.0+16014+a372c00b
Red Hat · RHEL 8 enterprise_linux:8::appstream	golang-src	0:1.17.12-1.module+el8.6.0+16014+a372c00b
Red Hat · RHEL 8 enterprise_linux:8::appstream	golang-tests	0:1.17.12-1.module+el8.6.0+16014+a372c00b

Vulnerabilities 10

High 7.5

CVE-2022-30630

Stack exhaustion in Glob on certain paths in io/fs

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

Go standard library io/fs golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
High 7.5

CVE-2022-30631

Stack exhaustion when reading certain archives in compress/gzip

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Go standard library compress/gzip golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
High 7.5

CVE-2022-30633

Stack exhaustion when unmarshaling certain documents in encoding/xml

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
High 7.5

CVE-2022-30635

Stack exhaustion when decoding certain messages in encoding/gob

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Go standard library encoding/gob golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Medium 6.5

CVE-2022-1705

Improper sanitization of Transfer-Encoding headers in net/http

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Medium 6.5

CVE-2022-32148

Exposure of client IP addresses in net/http

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set …

Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Medium 5.5

CVE-2022-1962

Stack exhaustion due to deeply nested types in go/parser

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

Go standard library go/parser golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Low 3.1

CVE-2022-30629

Session tickets lack random ticket_age_add in crypto/tls

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Unscored —

CVE-2022-28131

Stack exhaustion from deeply nested XML documents in encoding/xml

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Unscored —

CVE-2022-30632

Stack exhaustion on crafted paths in path/filepath

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Go standard library path/filepath golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107342
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107371
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107374
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107376
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107383
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107386
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107388
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107390
report
https://bugzilla.redhat.com/show_bug.cgi?id=2107392
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5775.json
report
https://access.redhat.com/security/cve/CVE-2022-1705
advisory
https://www.cve.org/CVERecord?id=CVE-2022-1705
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1705
article
https://go.dev/issue/53188
article
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
report
https://access.redhat.com/security/cve/CVE-2022-1962
advisory
https://www.cve.org/CVERecord?id=CVE-2022-1962
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1962
article
https://go.dev/issue/53616
report
https://access.redhat.com/security/cve/CVE-2022-28131
advisory
https://www.cve.org/CVERecord?id=CVE-2022-28131
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-28131
article
https://go.dev/issue/53614
report
https://access.redhat.com/security/cve/CVE-2022-30629
report
https://bugzilla.redhat.com/show_bug.cgi?id=2092793
advisory
https://www.cve.org/CVERecord?id=CVE-2022-30629
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30629
article
https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg
report
https://access.redhat.com/security/cve/CVE-2022-30630
advisory
https://www.cve.org/CVERecord?id=CVE-2022-30630
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30630
article
https://go.dev/issue/53415
report
https://access.redhat.com/security/cve/CVE-2022-30631
advisory
https://www.cve.org/CVERecord?id=CVE-2022-30631
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30631
article
https://go.dev/issue/53168
report
https://access.redhat.com/security/cve/CVE-2022-30632
advisory
https://www.cve.org/CVERecord?id=CVE-2022-30632

Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update

Fixed packages 11

Vulnerabilities 10

Stack exhaustion in Glob on certain paths in io/fs

Stack exhaustion when reading certain archives in compress/gzip

Stack exhaustion when unmarshaling certain documents in encoding/xml

Stack exhaustion when decoding certain messages in encoding/gob

Improper sanitization of Transfer-Encoding headers in net/http

Exposure of client IP addresses in net/http

Stack exhaustion due to deeply nested types in go/parser

Session tickets lack random ticket_age_add in crypto/tls

Stack exhaustion from deeply nested XML documents in encoding/xml

Stack exhaustion on crafted paths in path/filepath

References