USN-7111-1: Go vulnerabilities
14 November 2024
Several security issues were fixed in Go.
Releases
Packages
- golang-1.17 - Go programming language compiler - metapackage
Details
Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2
streams. An attacker could possibly use this issue to cause a denial of
service. (CVE-2022-41723)
Marten Seemann discovered that Go did not properly manage memory under
certain circumstances. An attacker could possibly use this issue to cause
a panic resulting in a denial of service. (CVE-2022-41724)
Ameya Darshan and Jakob Ackermann discovered that Go did not properly
validate the amount of memory and disk files ReadForm can consume. An
attacker could possibly use this issue to cause a panic resulting in a
denial of service. (CVE-2022-41725)
Jakob Ackermann discovered that Go incorrectly handled multipart
forms. An attacker could possibly use this issue to consume an excessive
amount of resources, resulting in a denial of service. (CVE-2023-24536)
It was discovered that Go did not properly validate the "//go:cgo_"
directives during compilation. An attacker could possibly use this issue
to inject arbitrary code during compile time. (CVE-2023-39323)
Bartek Nowotarski was discovered that the Go net/http module did not
properly handle the requests when request's headers exceed MaxHeaderBytes.
An attacker could possibly use this issue to cause a panic resulting into
a denial of service. (CVE-2023-45288)
Bartek Nowotarski discovered that the Go net/http module did not properly
validate the total size of the parsed form when parsing a multipart form.
An attacker could possibly use this issue to cause a panic resulting into a
denial of service. (CVE-2023-45290)
John Howard discovered that the Go crypto/x509 module did not properly
handle a certificate chain which contains a certificate with an unknown
public key algorithm. An attacker could possibly use this issue to cause
a panic resulting into a denial of service. (CVE-2024-24783)
Juho Nurminen discovered that the Go net/mail module did not properly
handle comments within display names in the ParseAddressList function.
An attacker could possibly use this issue to cause a panic resulting into
a denial of service. (CVE-2024-24784)
Yufan You discovered that the Go archive/zip module did not properly
handle certain types of invalid zip files differs from the behavior of
most zip implementations. An attacker could possibly use this issue to
cause a panic resulting into a denial of service. (CVE-2024-24789)
Geoff Franks discovered that the Go net/http module did not properly
handle responses to requests with an "Expect: 100-continue" header under
certain circumstances. An attacker could possibly use this issue to
cause a denial of service. (CVE-2024-24791)
It was discovered that the Go parser module did not properly handle deeply
nested literal values. An attacker could possibly use this issue to cause
a panic resulting in a denial of service. (CVE-2024-34155)
Md Sakib Anwar discovered that the Go encoding/gob module did not properly
handle message decoding under certain circumstances. An attacker could
possibly use this issue to cause a panic resulting in a denial of service.
(CVE-2024-34156)
It was discovered that the Go build module did not properly handle certain
build tag lines with deeply nested expressions. An attacker could possibly
use this issue to cause a panic resulting in a denial of service.
(CVE-2024-34158)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
-
golang-1.17
-
1.17.13-3ubuntu1.3
-
golang-1.17-go
-
1.17.13-3ubuntu1.3
-
golang-1.17-src
-
1.17.13-3ubuntu1.3
In general, a standard system update will make all the necessary changes.
Related notices
- USN-7081-1: golang-1.22-go, golang-1.22, golang-1.22-doc, golang-1.22-src
- USN-7109-1: golang-1.18, golang-1.18-go, golang-1.18-src, golang-1.18-doc
- USN-6140-1: golang-1.19, golang-1.19-doc, golang-1.19-src, golang-1.20-doc, golang-1.20-src, golang-1.20-go, golang-1.19-go, golang-1.20
- USN-6574-1: golang-1.20, golang-1.21-go, golang-1.20-src, golang-1.20-doc, golang-1.20-go, golang-1.21-doc, golang-1.21-src, golang-1.21
- USN-6886-1: golang-1.22-go, golang-1.21-go, golang-1.22-doc, golang-1.22, golang-1.22-src, golang-1.21-doc, golang-1.21-src, golang-1.21