{"affected":[{"ecosystem_specific":{"binaries":[{"go1.20-openssl":"1.20.11.1-150000.1.14.1","go1.20-openssl-doc":"1.20.11.1-150000.1.14.1","go1.20-openssl-race":"1.20.11.1-150000.1.14.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","name":"go1.20-openssl","purl":"purl:rpm/suse/go1.20-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"go1.20-openssl":"1.20.11.1-150000.1.14.1","go1.20-openssl-doc":"1.20.11.1-150000.1.14.1","go1.20-openssl-race":"1.20.11.1-150000.1.14.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","name":"go1.20-openssl","purl":"purl:rpm/suse/go1.20-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"go1.20-openssl":"1.20.11.1-150000.1.14.1","go1.20-openssl-doc":"1.20.11.1-150000.1.14.1","go1.20-openssl-race":"1.20.11.1-150000.1.14.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.4","name":"go1.20-openssl","purl":"purl:rpm/suse/go1.20-openssl&distro=openSUSE%20Leap%2015.4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"go1.20-openssl":"1.20.11.1-150000.1.14.1","go1.20-openssl-doc":"1.20.11.1-150000.1.14.1","go1.20-openssl-race":"1.20.11.1-150000.1.14.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.5","name":"go1.20-openssl","purl":"purl:rpm/suse/go1.20-openssl&distro=openSUSE%20Leap%2015.5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for go1.20-openssl fixes the following issues:\n\nUpdate to version 1.20.11.1 cut from the go1.20-openssl-fips\nbranch at the revision tagged go1.20.11-1-openssl-fips.\n\n* Update to go1.20.11\n\n\ngo1.20.11 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker and the\nnet/http package.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* cmd/link: split text sections for arm 32-bit\n* net/http: http2 page fails on firefox/safari if pushing resources\n\n\nUpdate to version 1.20.10.1 cut from the go1.20-openssl-fips\nbranch at the revision tagged go1.20.10-1-openssl-fips.\n\n* Update to go1.20.10\n\n\ngo1.20.10 (released 2023-10-10) includes a security fix to the\nnet/http package.\n\n* security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work (bsc#1216109)\n\n  \ngo1.20.9 (released 2023-10-05) includes one security fixes to the\ncmd/go package, as well as bug fixes to the go command and the\nlinker.\n\n* security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build (bsc#1215985)\n* cmd/link: issues with Apple's new linker in Xcode 15 beta\n","id":"SUSE-SU-2023:4472-1","modified":"2023-11-16T18:01:39Z","published":"2023-11-16T18:01:39Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234472-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1206346"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215985"},{"type":"REPORT","url":"https://bugzilla.suse.com/1216109"},{"type":"REPORT","url":"https://bugzilla.suse.com/1216943"},{"type":"REPORT","url":"https://bugzilla.suse.com/1216944"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39323"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39325"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-44487"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-45283"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-45284"}],"related":["CVE-2023-39323","CVE-2023-39325","CVE-2023-44487","CVE-2023-45283","CVE-2023-45284"],"summary":"Security update for go1.20-openssl"}