Security update for go1.23 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3197-1 Final 1 1 2024-09-10T14:16:39Z current 2024-09-10T14:16:39Z 2024-09-10T14:16:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for go1.23 This update for go1.23 fixes the following issues: - Update go v1.23.1 - CVE-2024-34155: Fixed stack exhaustion in all Parse* functions. (bsc#1230252) - CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode. (bsc#1230253) - CVE-2024-34158: Fixed stack exhaustion in Parse. (bsc#1230254) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-3197,SUSE-SLE-SDK-12-SP5-2024-3197 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243197-1/ Link for SUSE-SU-2024:3197-1 https://lists.suse.com/pipermail/sle-updates/2024-September/036844.html E-Mail link for SUSE-SU-2024:3197-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1229122 SUSE Bug 1229122 https://bugzilla.suse.com/1230252 SUSE Bug 1230252 https://bugzilla.suse.com/1230253 SUSE Bug 1230253 https://bugzilla.suse.com/1230254 SUSE Bug 1230254 https://www.suse.com/security/cve/CVE-2024-34155/ SUSE CVE CVE-2024-34155 page https://www.suse.com/security/cve/CVE-2024-34156/ SUSE CVE CVE-2024-34156 page https://www.suse.com/security/cve/CVE-2024-34158/ SUSE CVE CVE-2024-34158 page SUSE Linux Enterprise Software Development Kit 12 SP5 go1.23-1.23.1-1.6.1 go1.23-doc-1.23.1-1.6.1 go1.23-1.23.1-1.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 go1.23-doc-1.23.1-1.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 SUSE Linux Enterprise Software Development Kit 12 SP5:go1.23-1.23.1-1.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:go1.23-doc-1.23.1-1.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243197-1/ https://www.suse.com/security/cve/CVE-2024-34155.html CVE-2024-34155 https://bugzilla.suse.com/1230252 SUSE Bug 1230252 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. CVE-2024-34156 SUSE Linux Enterprise Software Development Kit 12 SP5:go1.23-1.23.1-1.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:go1.23-doc-1.23.1-1.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243197-1/ https://www.suse.com/security/cve/CVE-2024-34156.html CVE-2024-34156 https://bugzilla.suse.com/1230253 SUSE Bug 1230253 Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. CVE-2024-34158 SUSE Linux Enterprise Software Development Kit 12 SP5:go1.23-1.23.1-1.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:go1.23-doc-1.23.1-1.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243197-1/ https://www.suse.com/security/cve/CVE-2024-34158.html CVE-2024-34158 https://bugzilla.suse.com/1230254 SUSE Bug 1230254