Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2023.1593 Security update for go1.19 17 March 2023 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: go1.19 Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2023-24532 CVE-2022-41725 CVE-2022-41724 CVE-2022-41723 CVE-2022-41722 Original Bulletin: https://www.suse.com/support/update/announcement/2023/suse-su-20230733-1 Comment: CVSS (Max): 7.5 CVE-2022-41723 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSS Source: [SUSE], NVD Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Security update for go1.19 Announcement ID: SUSE-SU-2023:0733-1 Rating: important o #1200441 o #1208269 o #1208270 References: o #1208271 o #1208272 o #1209030 o CVE-2022-41722 o CVE-2022-41723 Cross-References: o CVE-2022-41724 o CVE-2022-41725 o CVE-2023-24532 o CVE-2022-41722 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:H/I:N/A:N o CVE-2022-41723 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N /S:U/C:N/I:N/A:H o CVE-2022-41723 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:N/A:H o CVE-2022-41724 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N /S:U/C:N/I:N/A:H CVSS scores: o CVE-2022-41724 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:N/A:H o CVE-2022-41725 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N /S:U/C:N/I:N/A:H o CVE-2022-41725 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:N/A:H o CVE-2023-24532 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N /S:U/C:H/I:H/A:H o Development Tools Module 15-SP4 o openSUSE Leap 15.4 o SUSE Enterprise Storage 7.1 o SUSE Linux Enterprise Desktop 15 SP4 o SUSE Linux Enterprise High Performance Computing 15 SP3 o SUSE Linux Enterprise High Performance Computing 15 SP4 o SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 o SUSE Linux Enterprise High Performance Computing LTSS 15 Affected SP3 Products: o SUSE Linux Enterprise Real Time 15 SP3 o SUSE Linux Enterprise Real Time 15 SP4 o SUSE Linux Enterprise Server 15 SP3 o SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 o SUSE Linux Enterprise Server 15 SP4 o SUSE Linux Enterprise Server for SAP Applications 15 SP3 o SUSE Linux Enterprise Server for SAP Applications 15 SP4 o SUSE Manager Proxy 4.3 o SUSE Manager Retail Branch Server 4.3 o SUSE Manager Server 4.3 An update that solves five vulnerabilities and has one fix can now be installed. Description: This update for go1.19 fixes the following issues: o CVE-2022-41722: Fixed path traversal in filepath.Clean on Windows (bsc# 1208269). o CVE-2022-41723: Fixed quadratic complexity in HPACK decoding (bsc#1208270). o CVE-2022-41724: Fixed panic with arge handshake records in crypto/tls (bsc# 1208271). o CVE-2022-41725: Fixed denial of service from excessive resource consumption in net/http and mime/multipart (bsc#1208272). o CVE-2023-24532: Fixed incorrect P-256 ScalarMult and ScalarBaseMult results (bsc#1209030). Update to go1.19.7 * go#58441 runtime: some linkname signatures do not match * go#58502 cmd/link: relocation truncated to fit: R_ARM_CALL against `runtime.duffcopy' * go#58535 runtime: long latency of sweep assists * go#58716 net: TestTCPSelfConnect failures due to unexpected connections * go#58773 syscall: Environ uses an invalid unsafe.Pointer conversion on Windows * go#58810 crypto/x509: TestSystemVerify consistently failing Update to go1.19.6: * go#56154 net/http: bad handling of HEAD requests with a body * go#57635 crypto/x509: TestBoringAllowCert failures * go#57812 runtime: performance regression due to bad instruction used in morestack_noctxt for ppc64 in CL 425396 * go#58118 time: update zoneinfo_abbrs on Windows * go#58223 cmd/link: .go.buildinfo is gc'ed by --gc-sections * go#58449 cmd/go/internal/ modfetch: TestCodeRepo/gopkg.in_natefinch_lumberjack.v2/latest failing Update to go1.19.5 (bsc#1200441): * go#57706 Misc/cgo: backport needed for dlltool fix * go#57556 crypto/x509: re-allow duplicate attributes in CSRs * go# 57444 cmd/link: need to handle new-style LoongArch relocs * go#57427 crypto/ x509: Verify on macOS does not return typed errors * go#57345 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument. * go#57339 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices * go#57214 os: TestLstat failure on Linux Aarch64 * go#57212 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length * go#57124 sync/atomic: allow linked lists of atomic.Pointer * go#57100 cmd/compile: non-retpoline-compatible errors * go#57058 cmd/go: remove test dependency on gopkg.in service * go#57055 cmd/go: TestScript/ version_buildvcs_git_gpg (if enabled) fails on linux longtest builders * go# 56983 runtime: failure in TestRaiseException on windows-amd64-2012 * go#56834 cmd/link/internal/ppc64: too-far trampoline is reused * go#56770 cmd/compile: walkConvInterface produces broken IR * go#56744 cmd/compile: internal compiler error: missing typecheck * go#56712 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target * go#56154 net/http: bad handling of HEAD requests with a body Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-733=1 o Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-733=1 o SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-733=1 o SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-733=1 o SUSE Linux Enterprise Real Time 15 SP3 zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-733=1 o SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-733=1 o SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-733=1 o SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-733=1 Package List: o openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) go1.19-1.19.7-150000.1.23.1 go1.19-doc-1.19.7-150000.1.23.1 o openSUSE Leap 15.4 (aarch64 x86_64) go1.19-race-1.19.7-150000.1.23.1 o Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) go1.19-1.19.7-150000.1.23.1 go1.19-doc-1.19.7-150000.1.23.1 o Development Tools Module 15-SP4 (aarch64 x86_64) go1.19-race-1.19.7-150000.1.23.1 o SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) go1.19-1.19.7-150000.1.23.1 go1.19-doc-1.19.7-150000.1.23.1 go1.19-race-1.19.7-150000.1.23.1 o SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) go1.19-1.19.7-150000.1.23.1 go1.19-doc-1.19.7-150000.1.23.1 go1.19-race-1.19.7-150000.1.23.1 o SUSE Linux Enterprise Real Time 15 SP3 (x86_64) go1.19-1.19.7-150000.1.23.1 go1.19-doc-1.19.7-150000.1.23.1 go1.19-race-1.19.7-150000.1.23.1 o SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) go1.19-1.19.7-150000.1.23.1 go1.19-doc-1.19.7-150000.1.23.1 o SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 x86_64) go1.19-race-1.19.7-150000.1.23.1 o SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) go1.19-1.19.7-150000.1.23.1 go1.19-doc-1.19.7-150000.1.23.1 o SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) go1.19-race-1.19.7-150000.1.23.1 o SUSE Enterprise Storage 7.1 (aarch64 x86_64) go1.19-1.19.7-150000.1.23.1 go1.19-doc-1.19.7-150000.1.23.1 go1.19-race-1.19.7-150000.1.23.1 References: o https://www.suse.com/security/cve/CVE-2022-41722.html o https://www.suse.com/security/cve/CVE-2022-41723.html o https://www.suse.com/security/cve/CVE-2022-41724.html o https://www.suse.com/security/cve/CVE-2022-41725.html o https://www.suse.com/security/cve/CVE-2023-24532.html o https://bugzilla.suse.com/show_bug.cgiid=1200441 o https://bugzilla.suse.com/show_bug.cgiid=1208269 o https://bugzilla.suse.com/show_bug.cgiid=1208270 o https://bugzilla.suse.com/show_bug.cgiid=1208271 o https://bugzilla.suse.com/show_bug.cgiid=1208272 o https://bugzilla.suse.com/show_bug.cgiid=1209030 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBZBO7XckNZI30y1K9AQh7dRAAkESUfIN0IbKm9LwKXMQqTGr1rVDW9fl5 7BoFwXwvBrexYuxPg05AxCgbHCp1UrSEND+d37CW4kAkQPmt1oVUlr3YCAx9zIDw BXrLwjsft7xEX/ILtEweFay0/8fZhuoJYWgQKkqyq/85cMnd651eC7bpltn3Swpt Z9TCrUnaqgkQMa24zvrAZ9zdxxjfYXSASioTBcQVYnkYaAWWb352/Q8VqytupNRF NdNa+EREBCnbPwAIAHn4UJLu/X5jl+IuEvkmdQC0wpxyu7kjZMfKs9bdg8L3rt3V 9kEeJ+QTTZSuSez6JT/V2/1Y3CSEwul5fO8781H/73FUQUVfU/kBAZdfvnjDYdOv kXwOiHj6SufP3NzBiI1cgu1viXr6gqJsKU5qMacBzshoJiBoDLcdGD2cuNq2NlqZ HZLlmAZx05K3dJA6tIWq4OUDe6iaZXavt81wSLm1UJ0nZ5mNOaQBbu5t54MYcknz UGVTJtp782zPIy/uhzVBSt58pG+af8fKRovz3mZAiUgfFy2qBoCx+EmgMdbA1zp9 4TBvlWptky/gWnR4wH9b7/iYZ4yR+xPUGCwRFyVXjbw+aWuPlZDDrjDdaz4yiKTt XCCbEwLKigQlIfkJiVGtZ7grXJwjOkovF7343FQ2VTLkuqUf4PyfHhxouUkZKCXq 4RSZ0sVvLs0= =UtFj -----END PGP SIGNATURE-----