Summary
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
The following packages have been upgraded to a later upstream version: golang (1.15.7), delve (1.5.0). (BZ#1870531)
Security Fix(es):
* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)
* golang: cmd/go: packages using cgo can cause arbitrary code execution at build time (CVE-2021-3115)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | delve | 0:1.5.0-2.module+el8.4.0+396+d2d16ae3 |
| Rocky Linux · 8 | go-toolset | 0:1.15.7-1.module+el8.4.0+396+d2d16ae3 |
| Rocky Linux · 8 | golang | 0:1.15.7-1.module+el8.4.0+396+d2d16ae3 |
Vulnerabilities 2
-
Unscored —
Incorrect operations on the P-224 curve in crypto/elliptic
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
-
Unscored —
Arbitrary code injection via the go command with cgo on Windows in cmd/go
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).