-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2023.1593
                        Security update for go1.19
                               17 March 2023

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           go1.19
Publisher:         SUSE
Operating System:  SUSE
Resolution:        Patch/Upgrade
CVE Names:         CVE-2023-24532 CVE-2022-41725 CVE-2022-41724
                   CVE-2022-41723 CVE-2022-41722 

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2023/suse-su-20230733-1

Comment: CVSS (Max):  7.5 CVE-2022-41723 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
         CVSS Source: [SUSE], NVD
         Calculator:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

- --------------------------BEGIN INCLUDED TEXT--------------------

Security update for go1.19

Announcement ID:  SUSE-SU-2023:0733-1
     Rating:      important
                    o #1200441
                    o #1208269
                    o #1208270
   References:      o #1208271
                    o #1208272
                    o #1209030

                    o CVE-2022-41722
                    o CVE-2022-41723
Cross-References:   o CVE-2022-41724
                    o CVE-2022-41725
                    o CVE-2023-24532

                    o CVE-2022-41722 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
                      S:U/C:H/I:N/A:N
                    o CVE-2022-41723 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N
                      /S:U/C:N/I:N/A:H
                    o CVE-2022-41723 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
                      S:U/C:N/I:N/A:H
                    o CVE-2022-41724 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N
                      /S:U/C:N/I:N/A:H
  CVSS scores:      o CVE-2022-41724 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
                      S:U/C:N/I:N/A:H
                    o CVE-2022-41725 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N
                      /S:U/C:N/I:N/A:H
                    o CVE-2022-41725 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
                      S:U/C:N/I:N/A:H
                    o CVE-2023-24532 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N
                      /S:U/C:H/I:H/A:H

                    o Development Tools Module 15-SP4
                    o openSUSE Leap 15.4
                    o SUSE Enterprise Storage 7.1
                    o SUSE Linux Enterprise Desktop 15 SP4
                    o SUSE Linux Enterprise High Performance Computing 15 SP3
                    o SUSE Linux Enterprise High Performance Computing 15 SP4
                    o SUSE Linux Enterprise High Performance Computing ESPOS 15
                      SP3
                    o SUSE Linux Enterprise High Performance Computing LTSS 15
    Affected          SP3
    Products:       o SUSE Linux Enterprise Real Time 15 SP3
                    o SUSE Linux Enterprise Real Time 15 SP4
                    o SUSE Linux Enterprise Server 15 SP3
                    o SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
                    o SUSE Linux Enterprise Server 15 SP4
                    o SUSE Linux Enterprise Server for SAP Applications 15 SP3
                    o SUSE Linux Enterprise Server for SAP Applications 15 SP4
                    o SUSE Manager Proxy 4.3
                    o SUSE Manager Retail Branch Server 4.3
                    o SUSE Manager Server 4.3

An update that solves five vulnerabilities and has one fix can now be
installed.

Description:

This update for go1.19 fixes the following issues:

  o CVE-2022-41722: Fixed path traversal in filepath.Clean on Windows (bsc#
    1208269).
  o CVE-2022-41723: Fixed quadratic complexity in HPACK decoding (bsc#1208270).
  o CVE-2022-41724: Fixed panic with arge handshake records in crypto/tls (bsc#
    1208271).
  o CVE-2022-41725: Fixed denial of service from excessive resource consumption
    in net/http and mime/multipart (bsc#1208272).
  o CVE-2023-24532: Fixed incorrect P-256 ScalarMult and ScalarBaseMult results
    (bsc#1209030).

Update to go1.19.7
* go#58441 runtime: some linkname signatures do not match * go#58502 cmd/link:
relocation truncated to fit: R_ARM_CALL against `runtime.duffcopy' * go#58535
runtime: long latency of sweep assists * go#58716 net: TestTCPSelfConnect
failures due to unexpected connections * go#58773 syscall: Environ uses an
invalid unsafe.Pointer conversion on Windows * go#58810 crypto/x509:
TestSystemVerify consistently failing

Update to go1.19.6: * go#56154 net/http: bad handling of HEAD requests with a
body * go#57635 crypto/x509: TestBoringAllowCert failures * go#57812 runtime:
performance regression due to bad instruction used in morestack_noctxt for
ppc64 in CL 425396 * go#58118 time: update zoneinfo_abbrs on Windows * go#58223
cmd/link: .go.buildinfo is gc'ed by --gc-sections * go#58449 cmd/go/internal/
modfetch: TestCodeRepo/gopkg.in_natefinch_lumberjack.v2/latest failing

Update to go1.19.5 (bsc#1200441): * go#57706 Misc/cgo: backport needed for
dlltool fix * go#57556 crypto/x509: re-allow duplicate attributes in CSRs * go#
57444 cmd/link: need to handle new-style LoongArch relocs * go#57427 crypto/
x509: Verify on macOS does not return typed errors * go#57345 cmd/compile: the
loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its
"old" argument. * go#57339 syscall, internal/poll: accept4-to-accept fallback
removal broke Go code on Synology DSM 6.2 ARM devices * go#57214 os: TestLstat
failure on Linux Aarch64 * go#57212 reflect: sort.SliceStable sorts incorrectly
on arm64 with less function created with reflect.MakeFunc and slice of
sufficient length * go#57124 sync/atomic: allow linked lists of atomic.Pointer
* go#57100 cmd/compile: non-retpoline-compatible errors * go#57058 cmd/go:
remove test dependency on gopkg.in service * go#57055 cmd/go: TestScript/
version_buildvcs_git_gpg (if enabled) fails on linux longtest builders * go#
56983 runtime: failure in TestRaiseException on windows-amd64-2012 * go#56834
cmd/link/internal/ppc64: too-far trampoline is reused * go#56770 cmd/compile:
walkConvInterface produces broken IR * go#56744 cmd/compile: internal compiler
error: missing typecheck * go#56712 net: reenable
TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
* go#56154 net/http: bad handling of HEAD requests with a body

Patch Instructions:

To install this SUSE Important update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o openSUSE Leap 15.4
    zypper in -t patch openSUSE-SLE-15.4-2023-733=1
  o Development Tools Module 15-SP4
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-733=1
  o SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-733=1
  o SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-733=1
  o SUSE Linux Enterprise Real Time 15 SP3
    zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-733=1
  o SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-733=1
  o SUSE Linux Enterprise Server for SAP Applications 15 SP3
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-733=1
  o SUSE Enterprise Storage 7.1
    zypper in -t patch SUSE-Storage-7.1-2023-733=1

Package List:

  o openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
       go1.19-1.19.7-150000.1.23.1
       go1.19-doc-1.19.7-150000.1.23.1
  o openSUSE Leap 15.4 (aarch64 x86_64)
       go1.19-race-1.19.7-150000.1.23.1
  o Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64)
       go1.19-1.19.7-150000.1.23.1
       go1.19-doc-1.19.7-150000.1.23.1
  o Development Tools Module 15-SP4 (aarch64 x86_64)
       go1.19-race-1.19.7-150000.1.23.1
  o SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64
    x86_64)
       go1.19-1.19.7-150000.1.23.1
       go1.19-doc-1.19.7-150000.1.23.1
       go1.19-race-1.19.7-150000.1.23.1
  o SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64
    x86_64)
       go1.19-1.19.7-150000.1.23.1
       go1.19-doc-1.19.7-150000.1.23.1
       go1.19-race-1.19.7-150000.1.23.1
  o SUSE Linux Enterprise Real Time 15 SP3 (x86_64)
       go1.19-1.19.7-150000.1.23.1
       go1.19-doc-1.19.7-150000.1.23.1
       go1.19-race-1.19.7-150000.1.23.1
  o SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x
    x86_64)
       go1.19-1.19.7-150000.1.23.1
       go1.19-doc-1.19.7-150000.1.23.1
  o SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 x86_64)
       go1.19-race-1.19.7-150000.1.23.1
  o SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
       go1.19-1.19.7-150000.1.23.1
       go1.19-doc-1.19.7-150000.1.23.1
  o SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64)
       go1.19-race-1.19.7-150000.1.23.1
  o SUSE Enterprise Storage 7.1 (aarch64 x86_64)
       go1.19-1.19.7-150000.1.23.1
       go1.19-doc-1.19.7-150000.1.23.1
       go1.19-race-1.19.7-150000.1.23.1

References:

  o https://www.suse.com/security/cve/CVE-2022-41722.html
  o https://www.suse.com/security/cve/CVE-2022-41723.html
  o https://www.suse.com/security/cve/CVE-2022-41724.html
  o https://www.suse.com/security/cve/CVE-2022-41725.html
  o https://www.suse.com/security/cve/CVE-2023-24532.html
  o https://bugzilla.suse.com/show_bug.cgiid=1200441
  o https://bugzilla.suse.com/show_bug.cgiid=1208269
  o https://bugzilla.suse.com/show_bug.cgiid=1208270
  o https://bugzilla.suse.com/show_bug.cgiid=1208271
  o https://bugzilla.suse.com/show_bug.cgiid=1208272
  o https://bugzilla.suse.com/show_bug.cgiid=1209030

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBZBO7XckNZI30y1K9AQh7dRAAkESUfIN0IbKm9LwKXMQqTGr1rVDW9fl5
7BoFwXwvBrexYuxPg05AxCgbHCp1UrSEND+d37CW4kAkQPmt1oVUlr3YCAx9zIDw
BXrLwjsft7xEX/ILtEweFay0/8fZhuoJYWgQKkqyq/85cMnd651eC7bpltn3Swpt
Z9TCrUnaqgkQMa24zvrAZ9zdxxjfYXSASioTBcQVYnkYaAWWb352/Q8VqytupNRF
NdNa+EREBCnbPwAIAHn4UJLu/X5jl+IuEvkmdQC0wpxyu7kjZMfKs9bdg8L3rt3V
9kEeJ+QTTZSuSez6JT/V2/1Y3CSEwul5fO8781H/73FUQUVfU/kBAZdfvnjDYdOv
kXwOiHj6SufP3NzBiI1cgu1viXr6gqJsKU5qMacBzshoJiBoDLcdGD2cuNq2NlqZ
HZLlmAZx05K3dJA6tIWq4OUDe6iaZXavt81wSLm1UJ0nZ5mNOaQBbu5t54MYcknz
UGVTJtp782zPIy/uhzVBSt58pG+af8fKRovz3mZAiUgfFy2qBoCx+EmgMdbA1zp9
4TBvlWptky/gWnR4wH9b7/iYZ4yR+xPUGCwRFyVXjbw+aWuPlZDDrjDdaz4yiKTt
XCCbEwLKigQlIfkJiVGtZ7grXJwjOkovF7343FQ2VTLkuqUf4PyfHhxouUkZKCXq
4RSZ0sVvLs0=
=UtFj
-----END PGP SIGNATURE-----