Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | delve | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | delve-debuginfo | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | delve-debugsource | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | go-toolset | 0:1.19.6-1.module+el8.8.0+18289+edd6c8b6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang | 0:1.19.6-1.module+el8.8.0+18289+edd6c8b6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-bin | 0:1.19.6-1.module+el8.8.0+18289+edd6c8b6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-docs | 0:1.19.6-1.module+el8.8.0+18289+edd6c8b6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-misc | 0:1.19.6-1.module+el8.8.0+18289+edd6c8b6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-race | 0:1.19.6-1.module+el8.8.0+18289+edd6c8b6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-src | 0:1.19.6-1.module+el8.8.0+18289+edd6c8b6 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | golang-tests | 0:1.19.6-1.module+el8.8.0+18289+edd6c8b6 |
Vulnerabilities 3
-
High 7.5
Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
-
Unscored —
Panic on large handshake records in crypto/tls
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…
-
Unscored —
Excessive resource consumption in mime/multipart
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in th…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2167412
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2178488
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2178492
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3083.json
-
report
https://access.redhat.com/security/cve/CVE-2022-41723
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2178358
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-41723
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41723
-
advisory
https://github.com/advisories/GHSA-vvpx-j8f3-3w6h
-
article
https://go.dev/cl/468135
-
article
https://go.dev/cl/468295
-
article
https://go.dev/issue/57855
-
article
https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
-
advisory
https://pkg.go.dev/vuln/GO-2023-1571
-
article
https://vuln.go.dev/ID/GO-2023-1571.json
-
report
https://access.redhat.com/security/cve/CVE-2022-41724
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-41724
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41724
-
article
https://go.dev/cl/468125
-
article
https://go.dev/issue/58001
-
advisory
https://pkg.go.dev/vuln/GO-2023-1570
-
report
https://access.redhat.com/security/cve/CVE-2022-41725
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-41725
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41725
-
article
https://go.dev/cl/468124
-
article
https://go.dev/issue/58006
-
advisory
https://pkg.go.dev/vuln/GO-2023-1569