CVE-2022-41722

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

A path traversal vulnerability exists in filepath.Clean on Windows.

On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.

After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

These are all security issues fixed in the go1.19-1.19.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.20-1.20.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.19 fixes the following issues:

• CVE-2022-41722: Fixed path traversal in filepath.Clean on Windows (bsc#1208269).
• CVE-2022-41723: Fixed quadratic complexity in HPACK decoding (bsc#1208270).
• CVE-2022-41724: Fixed panic with arge handshake records in crypto/tls (bsc#1208271).
• CVE-2022-41725: Fixed denial of service from excessive resource consumption in net/http and mime/multipart (bsc#1208272).
• CVE-2023-24532: Fixed incorrect P-256 ScalarMult and ScalarBaseMult results (bsc#1209030).

Update to go1.19.7

• go#58441 runtime: some linkname signatures do not match
• go#58502 cmd/link: relocation truncated to fit: R_ARM_CALL against `runtime.duffcopy'
• go#58535 runtime: long latency of sweep assists
• go#58716 net: TestTCPSelfConnect failures due to unexpected connections
• go#58773 syscall: Environ uses an invalid unsafe.Pointer conversion on Windows
• go#58810 crypto/x509: TestSystemVerify consistently failing

Update to go1.19.6:

• go#56154 net/http: bad handling of HEAD requests with a body
• go#57635 crypto/x509: TestBoringAllowCert failures
• go#57812 runtime: performance regression due to bad instruction used in morestack_noctxt for ppc64 in CL 425396
• go#58118 time: update zoneinfo_abbrs on Windows
• go#58223 cmd/link: .go.buildinfo is gc'ed by --gc-sections
• go#58449 cmd/go/internal/modfetch: TestCodeRepo/gopkg.in_natefinch_lumberjack.v2/latest failing

Update to go1.19.5 (bsc#1200441):

• go#57706 Misc/cgo: backport needed for dlltool fix
• go#57556 crypto/x509: re-allow duplicate attributes in CSRs
• go#57444 cmd/link: need to handle new-style LoongArch relocs
• go#57427 crypto/x509: Verify on macOS does not return typed errors
• go#57345 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its 'old' argument.
• go#57339 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
• go#57214 os: TestLstat failure on Linux Aarch64
• go#57212 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
• go#57124 sync/atomic: allow linked lists of atomic.Pointer
• go#57100 cmd/compile: non-retpoline-compatible errors
• go#57058 cmd/go: remove test dependency on gopkg.in service
• go#57055 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
• go#56983 runtime: failure in TestRaiseException on windows-amd64-2012
• go#56834 cmd/link/internal/ppc64: too-far trampoline is reused
• go#56770 cmd/compile: walkConvInterface produces broken IR
• go#56744 cmd/compile: internal compiler error: missing typecheck
• go#56712 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
• go#56154 net/http: bad handling of HEAD requests with a body

This update for go1.20 fixes the following issues:

• Improvements to go1.x packaging spec:

  • On Tumbleweed bootstrap with current default gcc13 and gccgo118
  • On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap using go1.x package (%bcond_without gccgo). This is no longer needed on current SLE-12:Update and removing will consolidate the build configurations used.
  • Change source URLs to go.dev as per Go upstream
  • On x86_64 export GOAMD64=v1 as per the current baseline. At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  • On x86_64 %define go_amd64=v1 as current instruction baseline
  • In %check on x86_64 use value %go_amd64=v1 as GOAMD64=v1 to grep correct TSAN version is checked out from LLVM with new spelling for internal/amd64v1/race_linux.syso

go1.20.2 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the compiler, the covdata command, the linker, the runtime, and the crypto/ecdh, crypto/rsa, crypto/x509, os, and syscall packages. (boo#1206346)

• CVE-2023-24532: crypto/elliptic: Fixed that specific unreduced P-256 scalars produce incorrect results (boo#1209030)

• cmd/covdata: short read on string table when merging coverage counters

• runtime: some linkname signatures do not match

• cmd/compile: inline static init cause compile time error

• cmd/compile: internal compiler error: '(*Tree[go.shape.int]).RemoveParent.func1': value .dict (nil) incorrectly live at entry

• crypto/ecdh: ECDH method doesn't check curve

• cmd/link: relocation truncated to fit: R_ARM_CALL against `runtime.duffcopy'

• crypto/internal/bigmod: flag amd64 assembly as noescape

• runtime: endless traceback when panic in generics funtion

• runtime: long latency of sweep assists

• syscall.Faccessat and os.LookPath regression in Go 1.20

• os: cmd/go gets error 'copy_file_range: function not implemented'

• net: TestTCPSelfConnect failures due to unexpected connections

• syscall: Environ uses an invalid unsafe.Pointer conversion on Windows

• cmd/compile: ICE on method value involving imported anonymous interface

• crypto/x509: Incorrect documentation for ParsePKCS8PrivateKey

• crypto/x509: TestSystemVerify consistently failing

go1.20.1 (released 2023-02-14) includes security fixes to the crypto/tls, mime/multipart, net/http, and path/filepath packages, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the time package. (bsc#1206346)

• CVE-2022-41722 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725

  • bsc#1208269 security: fix CVE-2022-41722 path/filepath: path traversal in filepath.Clean on Windows
  • bsc#1208270 security: fix CVE-2022-41723 net/http: avoid quadratic complexity in HPACK decoding
  • bsc#1208271 security: fix CVE-2022-41724 crypto/tls: large handshake records may cause panics
  • bsc#1208272 security: fix CVE-2022-41725 net/http, mime/multipart: denial of service from excessive resource consumption
  • time: update zoneinfo_abbrs on Windows
  • cmd/link: .go.buildinfo is gc'ed by --gc-sections
  • cmd/compile/internal/pgo: Detect sample value position instead of hard-coding
  • cmd/compile: constant overflows when assigned to package level var (Go 1.20 regression)
  • cmd/compile: internal compiler error: panic: interface conversion: ir.Node is *ir.CompLitExpr, not *ir.Name
  • cmd/compile: internal compiler error: Type.Elem UNION
  • runtime: GOOS=ios fails Apple's app validation due to use of private API
  • cmd/go/internal/test: stale flagdefs.go not detected by tests
  • all: test failures with ETXTBSY
  • cmd/go/internal/modfetch: TestCodeRepo/gopkg.in_natefinch_lumberjack.v2/latest failing

• go1.20 (released 2023-02-01) is a major release of Go. go1.20.x minor releases will be provided through February 2024. https://github.com/golang/go/wiki/Go-Release-Cycle go1.20 arrives six months after go1.19. Most of its changes are in the implementation of the toolchain, runtime, and libraries. …