Summary
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* Backport fix for https://github.com/golang/go/issues/56891 (BZ#2167412)
* Update Go to 1.19.6 (BZ#2174430)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | delve | 0:1.9.1-1.module+el8.8.0+1263+19d1a562 |
| Rocky Linux · 8 | go-toolset | 0:1.19.6-1.module+el8.8.0+1263+19d1a562 |
| Rocky Linux · 8 | golang | 0:1.19.6-1.module+el8.8.0+1263+19d1a562 |
Vulnerabilities 2
-
Unscored —
Panic on large handshake records in crypto/tls
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…
-
Unscored —
Excessive resource consumption in mime/multipart
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in th…