Description
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | golang-1.15 | 1.15~rc1-1 | — |
| Debian 10 | golang-1.11 | 1.11.6-1+deb10u4 | DSA-4848-1 |
| Debian 9 | golang-1.7 | 1.7.4-2+deb9u2 | DLA-2459-1 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u2 | DLA-2460-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | golang-1.13 +1 | No fix yet | — |
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | golang-1.13 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | golang-1.13 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | golang-1.13 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | delve | 1.3.2-3.module+el8.2.0+5581+896cb53e | RHSA-2020:3665 |
| RHEL 8 | golang +7 | 1.13.15-1.module+el8.2.0+7662+fa98b974 | RHSA-2020:3665 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | ior +10 | 1.1.11-2.el8 | RHSA-2020:5649 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.4.3-19.el8 | RHSA-2020:5649 |
| Red Hat Service Mesh 1 | servicemesh-operator | 1.1.11-3.el8 | RHSA-2020:5649 |
| Red Hat Service Mesh 1 | servicemesh-prometheus | 2.14.0-20.el8 | RHSA-2020:5649 |
| Red Hat Openshift Container Storage 4 | mcg | 5.6.0-39.2279a46.5.6.el8 | RHSA-2020:5606 |
| Red Hat OpenShift 4 | apb +2 | 2.0.3-3.el7 | RHSA-2021:0713 |
| Red Hat OpenShift 4 | atomic-enterprise-service-catalog +1 | 1:4.5.0-202010081312.p0.git.1808.498e523.el7 | RHBA-2020:4229 |
| Red Hat OpenShift 4 | atomic-openshift-service-idler | 4.5.0-202010081312.p0.git.15.d7814b2.el7 | RHBA-2020:4229 |
| Red Hat OpenShift 4 | buildah +1 | 1.11.6-9.rhaos4.5.el8 | RHSA-2021:0713 |
| Red Hat OpenShift 4 | containernetworking-plugins | 0.8.6-2.rhaos4.5.el7 | RHSA-2021:0713 |
| Red Hat OpenShift 4 | cri-o | 1.18.4-4.rhaos4.5.git6dee389.el7 | RHSA-2021:2122, RHSA-2021:0713, RHSA-2020:5119 |
| Red Hat OpenShift 4 | cri-tools | 1.18.0-4.el7 | RHSA-2021:2122, RHSA-2021:0713 |
| Red Hat OpenShift 4 | faq | 0.0.6-5.el7 | RHBA-2020:5123 |
| Red Hat OpenShift 4 | ignition +1 | 0.35.1-12.rhaos4.5.gitb4d18ad.el8 | RHSA-2021:1016, RHBA-2020:4197 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.6.1601368321-1.el8 | RHSA-2021:2122, RHSA-2020:4297 |
| Red Hat OpenShift 4 | kubefed-client | 4.5.0-202002271711.git.2.3bd46d6.el7 | RHSA-2021:1016 |
| Red Hat OpenShift 4 | machine-config-daemon | 4.5.0-202012050338.p0.git.2581.e7a62a7.el8 | RHBA-2020:5356 |
| Red Hat OpenShift 4 | openshift +1 | 4.4.0-202011130111.p0.git.0.4861dfa.el7 | RHSA-2021:0713, RHSA-2021:0172, RHBA-2020:5123 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.4.0-202011122017.p0.git.3445.6937a03.el7 | RHSA-2020:4297, RHBA-2020:5123 |
| Red Hat OpenShift 4 | openshift-eventrouter | 0.2-5.git7c289cc.el7 | RHSA-2021:1016, RHSA-2021:0956 |
| Red Hat OpenShift 4 | podman +3 | 1.9.3-2.rhaos4.5.el8 | RHSA-2021:1016, RHSA-2020:4297 |
| Red Hat OpenShift 4 | prometheus-promu +1 | 0.5.0-3.git642a960.el7 | RHSA-2021:1366, RHSA-2021:0713 |
| Red Hat OpenShift 4 | redhat-release-coreos | 47.83-2.el8 | RHSA-2021:2122 |
| Red Hat OpenShift 4 | runc | 1.0.0-81.rhaos4.6.git5b757d4.el7 | RHSA-2020:4297 |
| Red Hat OpenShift 4 | skopeo +2 | 1:1.1.1-2.rhaos4.5.el8 | RHSA-2021:1016, RHSA-2021:0172, RHSA-2020:4297 |
| Red Hat Devtools 2020 | go-toolset-1.13 +2 | 1.13.15-1.el7 | RHSA-2020:4214 |
| Red Hat Devtools 2020 | go-toolset-1.13-golang +6 | 1.13.15-3.el7 | RHSA-2020:4214 |
| Red Hat Container Native Virtualization 4 | kubevirt +2 | 4.9.0-287.el7 | RHSA-2021:4103 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | go1.14 | 1.14.7-1.15.1 | SUSE-SU-2020:2562-1 |
| SLES 15 SP1 | go1.14 | 1.14.7-1.15.1 | SUSE-SU-2020:2562-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.13 | 1.13.15-2.6 | openSUSE-SU-2024:10806-1 |
| openSUSE Tumbleweed | go1.14 | 1.14.15-1.6 | openSUSE-SU-2024:10807-1 |
| openSUSE Leap 15.2 | go1.13 | 1.13.14-lp152.2.4.1 | openSUSE-SU-2020:1095-1 |
| openSUSE Leap 15.2 | go1.14 | 1.14.7-lp152.2.3.1 | openSUSE-SU-2020:1407-1 |
| openSUSE Leap 15.1 | go1.13 | 1.13.14-lp151.5.1 | openSUSE-SU-2020:1087-1 |
| openSUSE Leap 15.1 | go1.14 | 1.14.7-lp151.13.1 | openSUSE-SU-2020:1405-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.14.5-r0 | — |
| Alpine v3.23 | go | 1.14.5-r0 | — |
| Alpine v3.22 | go | 1.14.5-r0 | — |
| Alpine v3.21 | go | 1.14.5-r0 | — |
| Alpine v3.20 | go | 1.14.5-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | go | 1.14.5-r0 | — |
| Alpine v3.18 | go | 1.14.5-r0 | — |
| Alpine v3.17 | go | 1.14.5-r0 | — |
| Alpine v3.16 | go | 1.14.5-r0 | — |
| Alpine v3.15 | go | 1.14.5-r0 | — |
| Alpine v3.14 | go | 1.14.5-r0 | — |
| Alpine v3.13 | go | 1.14.5-r0 | — |
| Alpine v3.12 | go | 1.13.13-r0 | — |
| Alpine v3.11 | go | 1.13.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | golang +6 | 1.13.14-1.amzn2.0.1 | ALAS2-2020-1479 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
| Azure Linux 3 | python-tensorboard | 2.16.2-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | delve | 1.3.2-3.0.1.module+el8.2.0+5587+55f012d0 | ELSA-2020-3665 |
| Oracle Linux 8 | golang +7 | 1.13.15-1.module+el8.2.0+7788+3ff8dc7f | ELSA-2020-3665 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.13.13 · >= 1.14.0-0, < 1.14.5 | 1.13.13, 1.14.5 | GO-2021-0224 |
Advisories 31
- RHSA-2020:5606 Red Hat Security Advisory: Red Hat OpenShift Container Storage 4.6 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2020:4297 Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2020:4214 Red Hat Security Advisory: go-toolset-1.13-golang security and bug fix update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2020:3665 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:1366 Red Hat Security Advisory: OpenShift Container Platform 4.7.9 packages and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0956 Red Hat Security Advisory: OpenShift Container Platform 4.6.23 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0172 Red Hat Security Advisory: OpenShift Container Platform 4.6.13 packages and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2122 Red Hat Security Advisory: OpenShift Container Platform 4.7.13 packages and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:4103 Red Hat Security Advisory: OpenShift Virtualization 4.9.0 RPMs security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2021:1016 Red Hat Security Advisory: OpenShift Container Platform 4.5.37 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0713 Red Hat Security Advisory: OpenShift Container Platform 4.5.34 packages and security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:5649 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.11 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:5119 Red Hat Security Advisory: OpenShift Container Platform 4.5.20 packages and golang security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:5356 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.5.23 packages update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:5123 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.31 packages update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:4197 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6 GA RPMs Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:4229 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.5.15 packages update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4848-1 golang-1.11 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2459-1 golang-1.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2460-1 golang-1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10806-1 go1.13-1.13.15-2.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1095-1 Security update for go1.13 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:2562-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1405-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10807-1 go1.14-1.14.15-1.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1407-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- openSUSE-SU-2020:1087-1 Security update for go1.13 SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-1599 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
- ELSA-2020-3665 Moderate: go-toolset:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 11, 2020
- ALAS2-2020-1479 Moderate: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 24, 2020
References
- openSUSE-SU-2020:1087 vendor-advisory
- openSUSE-SU-2020:1095 vendor-advisory
- FEDORA-2020-d75360e2b0 vendor-advisory
- FEDORA-2020-9cd1204ba0 vendor-advisory
- openSUSE-SU-2020:1405 vendor-advisory
- openSUSE-SU-2020:1407 vendor-advisory
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update mailing-list
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update mailing-list
- DSA-4848 vendor-advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w
- https://security.netapp.com/advisory/ntap-20200731-0005/
- https://groups.google.com/forum/#%21topic/golang-announce/f2c5bqrGH_g
- https://www.cloudfoundry.org/blog/cve-2020-15586/