CVE-2021-41772

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: Command-line arguments may overwrite global data (CVE-2021-38297)

• golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)

• golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

• golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

• golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)

• golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

• golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: Command-line arguments may overwrite global data (CVE-2021-38297)

• golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)

• golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

• golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

• golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)

• golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

• golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

Previously, opening a zip with (*Reader).Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or ".." path elements.

Open could also panic if passed the empty string directly as an argument.

Now, any files in the zip whose name could not be made valid for fs.FS.Open will be skipped, and no longer added to the fs.FS file list, although they are still accessible through (*Reader).File.

Note that it was already the case that a file could be accessible from (*Reader).Open with a name different from the one in (*Reader).File, as the former is the cleaned name, while the latter is the original one.

Finally, the actual panic site was made robust as a defense-in-depth measure.

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. (CVE-2021-41771)

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field. (CVE-2021-41772)

This update for go1.16 fixes the following issues:

Security update go1.16.10 (released 2021-11-04) (bsc#1182345).

• CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
• CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.17 fixes the following issues:

Security update go1.17.3 (released 2021-11-04) (bsc#1190649).

• CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
• CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).

This update for go1.16 fixes the following issues:

Security update go1.16.10 (released 2021-11-04) (bsc#1182345).

• CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
• CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).

These are all security issues fixed in the go1.16-1.16.10-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.17-1.17.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.17 fixes the following issues:

Security update go1.17.3 (released 2021-11-04) (bsc#1190649).

• CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
• CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).

This update for go1.16 fixes the following issues:

Security update go1.16.10 (released 2021-11-04) (bsc#1182345).

• CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
• CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).