-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3395-1 debian-...@lists.debian.org https://www.debian.org/lts/security/ Sylvain Beucler April 19, 2023 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : golang-1.11 Version : 1.11.6-1+deb10u6 CVE ID : CVE-2020-28367 CVE-2021-33196 CVE-2021-36221 CVE-2021-38297 CVE-2021-39293 CVE-2021-41771 CVE-2021-44716 CVE-2021-44717 CVE-2022-23806 CVE-2022-24921 Debian Bug : 989492 991961 Multiple vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial-of-service (DoS), invalid cryptographic computation, information leak, or arbitrary code execution on the developer's computer in specific situations. CVE-2020-28367 Code injection in the go command with cgo allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. CVE-2021-33196 In archive/zip, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. CVE-2021-36221 Go has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. CVE-2021-38297 Go has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used. CVE-2021-39293 This issue exists because of an incomplete fix for CVE-2021-33196. CVE-2021-41771 ImportedSymbols in debug/macho (for Open or OpenFat) Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. CVE-2021-44716 net/http allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. CVE-2021-44717 Go on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion. CVE-2022-23806 Curve.IsOnCurve in crypto/elliptic can incorrectly return true in situations with a big.Int value that is not a valid field element. CVE-2022-24921 regexp.Compile allows stack exhaustion via a deeply nested expression. For Debian 10 buster, these problems have been fixed in version 1.11.6-1+deb10u6. We recommend that you upgrade your golang-1.11 packages. For the detailed security status of golang-1.11 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/golang-1.11 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmRAX94ACgkQDTl9HeUl XjAipQ//fPuoqFbeRqttwpVunHFwWGmuYy6W37nfJE0Sd1tAIRROgkTJY+inEQmK xQ3GM/DYjwovQWqIANp4u18uhKyWnDySkSXFWIYJmVzxVKH4eLxh6kI7zqVXWToS 31GxVhPBz4/8xDOjK6Jnep8UidL+tZTeM8CHWYQ0ljPI1IQ/5seG1tBdnhJOKdNt eoAzlB9szWza8Mf9pomhDV86EZ3YxCYnNMFYSRVlrInvicI+kGu4/W+5OEUL5fzW cU/oH/rnXry2UxPFr2SndqJmyqEhDrbhlX/2xAA78RcZjK2V/yy4e2ZtPkM85U6/ kJDI+VZTgge5Rfjc6uL0UPmRhNutQpCUun22RP6kg44X2Oj+CrsZ9tGa5KFLX3V/ 9GCIEmWeb47gaFaR23pS/Q2ENHSoLF0zdd+rgaY4ReNd4wpPSf5kfaYZOjimjaSo xG64pLjDk5givMPwKRT5oZ+hN4czA9iogJFJ4RP3K725VQ1hSXqm2nlGHJlQO8mT AGcxS4YyR8v2Cgxe2dCur4Lke0qcPZfW2q1mSo0CLq0+frirc4Vdf2tI6T28C7Kb rnwugEMHSkWBGmF3bGD8dzFXQdVvaZZkVnpBUtl6pOaRpXKDIz2RqCWtJhv9lRi4 Dl4YFoXadRGJtbSHn8iyXey6Bf/V9H4fKJGTJpW/KyGgFPxEwxE= =7U79 -----END PGP SIGNATURE-----