CVE-2024-34155
Publication date 6 September 2024
Last updated 14 November 2024
Ubuntu priority
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Status
Package | Ubuntu Release | Status |
---|---|---|
golang | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
golang-1.10 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Ignored end of ESM support, was needs-triage | |
golang-1.13 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
golang-1.14 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Needs evaluation
|
|
golang-1.16 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
golang-1.17 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy |
Fixed 1.17.13-3ubuntu1.3
|
|
20.04 LTS focal | Not in release | |
golang-1.18 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy |
Fixed 1.18.1-1ubuntu1.2
|
|
20.04 LTS focal |
Fixed 1.18.1-1ubuntu1~20.04.3
|
|
18.04 LTS bionic |
Fixed 1.18.1-1ubuntu1~18.04.4+esm1
|
|
16.04 LTS xenial |
Fixed 1.18.1-1ubuntu1~16.04.6+esm1
|
|
golang-1.19 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
golang-1.20 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
golang-1.21 | 24.10 oracular | Not in release |
24.04 LTS noble |
Needs evaluation
|
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
golang-1.22 | 24.10 oracular |
Not affected
|
24.04 LTS noble |
Fixed 1.22.2-2ubuntu0.3
|
|
22.04 LTS jammy |
Fixed 1.22.2-2~22.04.2
|
|
20.04 LTS focal |
Fixed 1.22.2-2~20.04.2
|
|
golang-1.6 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
16.04 LTS xenial |
Needs evaluation
|
|
golang-1.8 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Needs evaluation
|
|
golang-1.9 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
mdeslaur
Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. Warning: do not include nullboot in the list of no-change rebuilds after fixing an issue in golang.
References
Related Ubuntu Security Notices (USN)
- USN-7081-1
- Go vulnerabilities
- 23 October 2024
- USN-7111-1
- Go vulnerabilities
- 14 November 2024
- USN-7109-1
- Go vulnerabilities
- 14 November 2024
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-34155
- https://groups.google.com/g/golang-announce/c/K-cEzDeCtpc
- https://github.com/golang/go/commit/53487e5477151ed75da50e50a0ba8f1ca64c00a3 (go1.23.1)
- https://github.com/golang/go/commit/b232596139dbe96a62edbe3a2a203e856bf556eb (go1.22.7)
- https://go.dev/cl/611238
- https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
- https://pkg.go.dev/vuln/GO-2024-3105