CVE-2024-24785

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

The Go Programming Language.

Security Fix(es):

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.(CVE-2023-45289)

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.(CVE-2023-45290)

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.(CVE-2024-24783)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.(CVE-2022-27649)

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.(CVE-2022-2989)

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.(CVE-2023-0778)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.(CVE-2022-27649)

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.(CVE-2022-2989)

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.(CVE-2023-0778)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.(CVE-2024-28176)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.(CVE-2024-28176)

%{expand:

Security Fix(es):

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.(CVE-2023-45290)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

%{expand:

Security Fix(es):

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.(CVE-2023-45290)

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.(CVE-2024-24783)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)

• crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

• github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload (CVE-2025-65637)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
• golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)
• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
• golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)
• golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)
• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

• golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
• crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
• github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload (CVE-2025-65637)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

• Rebuild with golang >= 1.22.5 to fix CVE-2022-1705, CVE-2022-41717, CVE-2023-29406, CVE-2023-39318, CVE-2023-39319, CVE-2023-39326, CVE-2023-45290, CVE-2024-24785, CVE-2024-24791

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

These are all security issues fixed in the go1.22-1.22.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.21-1.21.8-1.1 package on the GA media of openSUSE Tumbleweed.

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

• golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

This update for go1.21 fixes the following issues:

• Upgrade go to version 1.21.8
• CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000)
• CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001)
• CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999)
• CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002)
• CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)

This update for go1.21 fixes the following issues:

• Upgrade go to version 1.21.8
• CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000)
• CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001)
• CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999)
• CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002)
• CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)

This update for go1.22 fixes the following issues:

• Upgrade go to version 1.22.1
• CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000)
• CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001)
• CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999)
• CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002)
• CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)

This update for go1.22 fixes the following issues:

• go1.22.1 (released 2024-03-05) includes security fixes to the crypto/x509, html/template, net/http, net/http/cookiejar, and net/mail packages, as well as bug fixes to the compiler, the go command, the runtime, the trace command, and the go/types and net/http packages. (bsc#1218424)

  CVE-2023-45289 CVE-2023-45290 CVE-2024-24783 CVE-2024-24784 CVE-2024-24785

  • go#65831 go#65390 bsc#1220999 security: fix CVE-2024-24783 crypto/x509: Verify panics on certificates with an unknown public key algorithm
  • go#65849 go#65083 bsc#1221002 security: fix CVE-2024-24784 net/mail: comments in display names are incorrectly handled
  • go#65850 go#65383 bsc#1221001 security: fix CVE-2023-45290 net/http: memory exhaustion in Request.ParseMultipartForm
  • go#65859 go#65065 bsc#1221000 security: fix CVE-2023-45289 net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect
  • go#65969 go#65697 bsc#1221003 security: fix CVE-2024-24785 html/template: errors returned from MarshalJSON methods may break template escaping
  • go#65352 cmd/go: go generate fails silently when run on a package in a nested workspace module
  • go#65471 internal/testenv: TestHasGoBuild failures on the LUCI noopt builders
  • go#65474 internal/testenv: support LUCI mobile builders in testenv tests
  • go#65577 cmd/trace/v2: goroutine analysis page doesn't identify goroutines consistently
  • go#65618 cmd/compile: Go 1.22 build fails with 1.21 PGO profile on internal/saferio change
  • go#65619 cmd/compile: Go 1.22 changes support for modules that declare go 1.0
  • go#65641 cmd/cgo/internal/testsanitizers,x/build: LUCI clang15 builders failing
  • go#65644 runtime: crash in race detector when execution tracer reads from CPU profile buffer
  • go#65728 go/types: nil pointer dereference in Alias.Underlying()
  • go#65759 net/http: context cancellation can leave HTTP client with deadlocked HTTP/1.1 connections in Go1.22
  • go#65760 runtime: Go 1.22.0 fails to build from source on armv7 Alpine Linux
  • go#65818 runtime: go1.22.0 test with -race will SIGSEGV or SIGBUS or Bad Pointer
  • go#65852 cmd/go: 'missing ziphash' error with go.work
  • go#65883 runtime: scheduler sometimes starves a runnable goroutine on wasm platforms

• Packaging improvements:

  • bsc#1219988 ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack

• go1.22 (released 2024-02-06) is a major release of Go. go1.22.x minor releases will be provided through February 2024. https://github.com/golang/go/wiki/Go-Release-Cycle go1.22 arrives six months after go1.21. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before. (bsc#1218424)

  • Language change: go1.22 makes two changes to for loops. Previously, the variables declared by a for loop were created once and updated by each iteration. In go1.22, each iteration of the loop creates new variables, to avoid accidental sharing bugs. The transition support tooling described in the proposal continues to work in the same way it did in Go 1.21.
  • Language change: For loops may now range over integers
  • Language change: go1.22 includes a preview of a language change we are considering for a future version of Go: range-over-function iterators. Building with GOEXPERIMENT=rangefunc enables this feature.
  • go command: Commands in workspaces can now use a vendor directory containing the dependencies of the workspace. The directory is created by go work vendor, and used by build commands when the -mod flag is set to vendor, which is the default when a workspace vendor directory is present. Note that the vendor directory's contents for a workspace are different from those of a…

This update for go1.21-openssl fixes the following issues:

• CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)
• CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
• CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)
• CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000)
• CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
• CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)
• CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
• CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)

Other fixes:

• Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
• Update to version 1.21.13 (bsc#1212475)
• Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
• Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

This update for go1.21-openssl fixes the following issues:

• CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)
• CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
• CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)
• CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000)
• CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
• CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)
• CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
• CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)

Other fixes:

• Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
• Update to version 1.21.13 (bsc#1212475)
• Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
• Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

This update for go1.22-openssl fixes the following issues:

This update ships go1.22-openssl 1.22.7.1 (jsc#SLE-18320)

• Update to version 1.22.7.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.7-1-openssl-fips.

  • Update to Go 1.22.7 (#229)

• go1.22.7 (released 2024-09-05) includes security fixes to the encoding/gob, go/build/constraint, and go/parser packages, as well as bug fixes to the fix command and the runtime.

  CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:

  • go#69142 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)
  • go#69144 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)
  • go#69148 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)
  • go#68811 os: TestChtimes failures
  • go#68825 cmd/fix: fails to run on modules whose go directive value is in '1.n.m' format introduced in Go 1.21.0
  • go#68972 cmd/cgo: aix c-archive corrupting stack

• go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler, the linker, the trace command, the covdata command, and the bytes, go/types, and os/exec packages.

  • go#68594 cmd/compile: internal compiler error with zero-size types
  • go#68546 cmd/trace/v2: pprof profiles always empty
  • go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop
  • go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm
  • go#68370 go/types: assertion failure in recent range statement checking logic
  • go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows
  • go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race
  • go#68222 cmd/go: list with -export and -covermode=atomic fails to build
  • go#68198 cmd/link: issues with Xcode 16 beta

• Update to version 1.22.5.3 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-3-openssl-fips.

  • Only load openssl if fips == '1' Avoid loading openssl whenever GOLANG_FIPS is not 1. Previously only an unset variable would cause the library load to be skipped, but users may also expect to be able to set eg. GOLANG_FIPS=0 in environments without openssl.

• Update to version 1.22.5.2 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-2-openssl-fips.

  • Only load OpenSSL when in FIPS mode

• Update to version 1.22.5.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-1-openssl-fips.

  • Update to go1.22.5

• go1.22.5 (released 2024-07-02) includes security fixes to the net/http package, as well as bug fixes to the compiler, cgo, the go command, the linker, the runtime, and the crypto/tls, go/types, net, net/http, and os/exec packages.

  CVE-2024-24791:

  • go#68200 go#67555 bsc#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways
  • go#65983 cmd/compile: hash of unhashable type
  • go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()
  • go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without '.exe' no longer implicitly adds '.exe' in Go 1.22
  • go#67298 runtime: 'fatal: morestack on g0' on amd64 after upgrade to Go 1.21, stale bounds
  • go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders
  • go#67798 cmd/compile: internal compiler error: unexpected type: <nil> (<nil>) in for-range
  • go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec
  • go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0
  • go#67934 net: go DNS resolver fails to connect to local DNS server
  • go#67945 cmd/link: using -fuzz…

This update for go1.22-openssl fixes the following issues:

This update ships go1.22-openssl 1.22.7.1 (jsc#SLE-18320)

• Update to version 1.22.7.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.7-1-openssl-fips.

  • Update to Go 1.22.7 (#229)

• go1.22.7 (released 2024-09-05) includes security fixes to the encoding/gob, go/build/constraint, and go/parser packages, as well as bug fixes to the fix command and the runtime.

  CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:

  • go#69142 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)
  • go#69144 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)
  • go#69148 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)
  • go#68811 os: TestChtimes failures
  • go#68825 cmd/fix: fails to run on modules whose go directive value is in '1.n.m' format introduced in Go 1.21.0
  • go#68972 cmd/cgo: aix c-archive corrupting stack

• go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler, the linker, the trace command, the covdata command, and the bytes, go/types, and os/exec packages.

  • go#68594 cmd/compile: internal compiler error with zero-size types
  • go#68546 cmd/trace/v2: pprof profiles always empty
  • go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop
  • go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm
  • go#68370 go/types: assertion failure in recent range statement checking logic
  • go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows
  • go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race
  • go#68222 cmd/go: list with -export and -covermode=atomic fails to build
  • go#68198 cmd/link: issues with Xcode 16 beta

• Update to version 1.22.5.3 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-3-openssl-fips.

  • Only load openssl if fips == '1' Avoid loading openssl whenever GOLANG_FIPS is not 1. Previously only an unset variable would cause the library load to be skipped, but users may also expect to be able to set eg. GOLANG_FIPS=0 in environments without openssl.

• Update to version 1.22.5.2 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-2-openssl-fips.

  • Only load OpenSSL when in FIPS mode

• Update to version 1.22.5.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-1-openssl-fips.

  • Update to go1.22.5

• go1.22.5 (released 2024-07-02) includes security fixes to the net/http package, as well as bug fixes to the compiler, cgo, the go command, the linker, the runtime, and the crypto/tls, go/types, net, net/http, and os/exec packages.

  CVE-2024-24791:

  • go#68200 go#67555 bsc#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways
  • go#65983 cmd/compile: hash of unhashable type
  • go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()
  • go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without '.exe' no longer implicitly adds '.exe' in Go 1.22
  • go#67298 runtime: 'fatal: morestack on g0' on amd64 after upgrade to Go 1.21, stale bounds
  • go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders
  • go#67798 cmd/compile: internal compiler error: unexpected type: <nil> (<nil>) in for-range
  • go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec
  • go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0
  • go#67934 net: go DNS resolver fails to connect to local DNS server
  • go#67945 cmd/link: using -fuzz…

It was discovered that the Go net/http module did not properly handle the requests when request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-45288)

It was discovered that the Go net/http module did not properly validate the subdomain match or exact match of the initial domain. An attacker could possibly use this issue to read sensitive information. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-45289)

It was discovered that the Go net/http module did not properly validate the total size of the parsed form when parsing a multipart form. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-45290)

It was discovered that the Go crypto/x509 module did not properly handle a certificate chain which contains a certificate with an unknown public key algorithm. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-24783)

It was discovered that the Go net/mail module did not properly handle comments within display names in the ParseAddressList function. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-24784)

It was discovered that the Go html/template module did not validate errors returned from MarshalJSON methods. An attacker could possibly use this issue to inject arbitrary code into the Go template. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-24785)

It was discovered that the Go net module did not properly validate the DNS message in response to a query. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.22. (CVE-2024-24788)

It was discovered that the Go archive/zip module did not properly handle certain types of invalid zip files differs from the behavior of most zip implementations. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24789)

It was discovered that the Go net/netip module did not work as expected for IPv4-mapped IPv6 addresses in various Is methods. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24790)

Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An attacker could possibly use this issue to run arbitrary commands. (CVE-2023-24531)

Sohom Datta discovered that Go did not properly validate backticks (`) as Javascript string delimiters, and did not escape them as expected. An attacker could possibly use this issue to inject arbitrary Javascript code into the Go template. (CVE-2023-24538)

Juho Nurminen discovered that Go incorrectly handled certain special characters in directory or file paths. An attacker could possibly use this issue to inject code into the resulting binaries. (CVE-2023-29402)

Vincent Dehors discovered that Go incorrectly handled permission bits. An attacker could possibly use this issue to read or write files with elevated privileges. (CVE-2023-29403)

Juho Nurminen discovered that Go incorrectly handled certain crafted arguments. An attacker could possibly use this issue to execute arbitrary code at build time. (CVE-2023-29405)

It was discovered that Go incorrectly validated the contents of host headers. A remote attacker could possibly use this issue to inject additional headers or entire requests. (CVE-2023-29406)

Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)

It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the net/http module. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2023-39325)

It was discovered that the Go html/template module did not validate errors returned from MarshalJSON methods. An attacker could possibly use this issue to inject arbitrary code into the Go template. (CVE-2024-24785)

Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-41723)

Marten Seemann discovered that Go did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41724)

Ameya Darshan and Jakob Ackermann discovered that Go did not properly validate the amount of memory and disk files ReadForm can consume. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41725)

Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An attacker could possibly use this issue to run arbitrary commands. (CVE-2023-24531)

Jakob Ackermann discovered that Go incorrectly handled multipart forms. An attacker could possibly use this issue to consume an excessive amount of resources, resulting in a denial of service. (CVE-2023-24536)

Juho Nurminen discovered that Go incorrectly handled certain special characters in directory or file paths. An attacker could possibly use this issue to inject code into the resulting binaries. (CVE-2023-29402)

Vincent Dehors discovered that Go incorrectly handled permission bits. An attacker could possibly use this issue to read or write files with elevated privileges. (CVE-2023-29403)

Juho Nurminen discovered that Go incorrectly handled certain compiler directives. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-29404)

Juho Nurminen discovered that Go incorrectly handled certain crafted arguments. An attacker could possibly use this issue to execute arbitrary code at build time. (CVE-2023-29405)

Bartek Nowotarski discovered that Go incorrectly validated the contents of host headers. A remote attacker could possibly use this issue to inject additional headers or entire requests. (CVE-2023-29406)

Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)

It was discovered that Go did not properly validate the "//go:cgo_" directives during compilation. An attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323)

It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the net/http module. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2023-39325)

Bartek Nowotarski was discovered that the Go net/http module did not properly handle the requests when request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-45288)

Bartek Nowotarski discovered that the Go net/http module did not properly validate the total size of the parsed form when parsing a multipart form. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-45290)

John Howard discovered that the Go crypto/x509 module did not properly handle a certificate chain which contains a certificate with an unknown public key algorithm. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24783)

Juho Nurminen discovered that the Go net/mail module did not properly handle comments within display names in the ParseAddressList function. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24784)

It was discovered that the Go html/template module did not validate errors returned from MarshalJSON methods. An attacker could possibly use this issue to inject arbitrary code into the Go template. (CVE-2024-24785)

Yufan You discovered that the Go archive/zip module…