Red Hat Security Advisory: golang security update

Fixed packages 7

Vulnerabilities 2

• Critical 9.8
  CVE-2024-24790

  Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

  Go standard library net/netip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2292787
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5075.json
• report
  https://access.redhat.com/security/cve/CVE-2023-45290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45290
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45290
• article
  http://www.openwall.com/lists/oss-security/2024/03/08/4
• article
  https://go.dev/cl/569341
• article
  https://go.dev/issue/65383
• article
  https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• advisory
  https://pkg.go.dev/vuln/GO-2024-2599
• article
  https://security.netapp.com/advisory/ntap-20240329-0004
• report
  https://access.redhat.com/security/cve/CVE-2024-24790
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24790
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24790