go1.15-1.15.15-1.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10808-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z go1.15-1.15.15-1.2 on GA media These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10808 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2020-24553/ SUSE CVE CVE-2020-24553 page https://www.suse.com/security/cve/CVE-2020-28362/ SUSE CVE CVE-2020-28362 page https://www.suse.com/security/cve/CVE-2020-28366/ SUSE CVE CVE-2020-28366 page https://www.suse.com/security/cve/CVE-2020-28367/ SUSE CVE CVE-2020-28367 page https://www.suse.com/security/cve/CVE-2021-27918/ SUSE CVE CVE-2021-27918 page https://www.suse.com/security/cve/CVE-2021-3114/ SUSE CVE CVE-2021-3114 page https://www.suse.com/security/cve/CVE-2021-3115/ SUSE CVE CVE-2021-3115 page https://www.suse.com/security/cve/CVE-2021-31525/ SUSE CVE CVE-2021-31525 page https://www.suse.com/security/cve/CVE-2021-33195/ SUSE CVE CVE-2021-33195 page https://www.suse.com/security/cve/CVE-2021-33196/ SUSE CVE CVE-2021-33196 page https://www.suse.com/security/cve/CVE-2021-33197/ SUSE CVE CVE-2021-33197 page https://www.suse.com/security/cve/CVE-2021-33198/ SUSE CVE CVE-2021-33198 page https://www.suse.com/security/cve/CVE-2021-34558/ SUSE CVE CVE-2021-34558 page https://www.suse.com/security/cve/CVE-2021-36221/ SUSE CVE CVE-2021-36221 page openSUSE Tumbleweed go1.15-1.15.15-1.2 go1.15-doc-1.15.15-1.2 go1.15-race-1.15.15-1.2 go1.15-1.15.15-1.2 as a component of openSUSE Tumbleweed go1.15-doc-1.15.15-1.2 as a component of openSUSE Tumbleweed go1.15-race-1.15.15-1.2 as a component of openSUSE Tumbleweed Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. CVE-2020-24553 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-24553.html CVE-2020-24553 https://bugzilla.suse.com/1176031 SUSE Bug 1176031 Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-28362.html CVE-2020-28362 https://bugzilla.suse.com/1178750 SUSE Bug 1178750 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file. CVE-2020-28366 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-28366.html CVE-2020-28366 https://bugzilla.suse.com/1178753 SUSE Bug 1178753 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. CVE-2020-28367 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-28367.html CVE-2020-28367 https://bugzilla.suse.com/1178752 SUSE Bug 1178752 encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method. CVE-2021-27918 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-27918.html CVE-2021-27918 https://bugzilla.suse.com/1183333 SUSE Bug 1183333 In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field. CVE-2021-3114 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3114.html CVE-2021-3114 https://bugzilla.suse.com/1181145 SUSE Bug 1181145 Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download). CVE-2021-3115 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3115.html CVE-2021-3115 https://bugzilla.suse.com/1181146 SUSE Bug 1181146 net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations. CVE-2021-31525 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-31525.html CVE-2021-31525 https://bugzilla.suse.com/1185790 SUSE Bug 1185790 Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. CVE-2021-33195 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-33195.html CVE-2021-33195 https://bugzilla.suse.com/1187443 SUSE Bug 1187443 In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. CVE-2021-33196 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-33196.html CVE-2021-33196 https://bugzilla.suse.com/1186622 SUSE Bug 1186622 https://bugzilla.suse.com/1190589 SUSE Bug 1190589 In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. CVE-2021-33197 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 low 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-33197.html CVE-2021-33197 https://bugzilla.suse.com/1187444 SUSE Bug 1187444 In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. CVE-2021-33198 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-33198.html CVE-2021-33198 https://bugzilla.suse.com/1187445 SUSE Bug 1187445 The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. CVE-2021-34558 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-34558.html CVE-2021-34558 https://bugzilla.suse.com/1188229 SUSE Bug 1188229 Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. CVE-2021-36221 openSUSE Tumbleweed:go1.15-1.15.15-1.2 openSUSE Tumbleweed:go1.15-doc-1.15.15-1.2 openSUSE Tumbleweed:go1.15-race-1.15.15-1.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-36221.html CVE-2021-36221 https://bugzilla.suse.com/1189162 SUSE Bug 1189162