CVE-2020-14039

In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.

In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.

On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in VerifyOptions.KeyUsages. This may allow a certificate to be used for an unintended purpose.

This update for go1.13 fixes the following issues:

• go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the database/sql, net/http, and reflect packages Refs bsc#1149259 go1.13 release tracking
  • go#39925 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39848 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39823 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39697 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39561 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it tries to use an older version of dlv which only supports linux/amd64
  • go#39538 net: TestDialParallel is flaky on windows-amd64-longtest
  • go#39287 cmd/vet: update for new number formats
  • go#40211 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40209 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)
  • go#38932 runtime: preemption in startTemplateThread may cause infinite hang
  • go#36689 go/types, math/big: data race in go/types due to math/big.Rat accessors unsafe for concurrent use
• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.13 fixes the following issues:

• go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the database/sql, net/http, and reflect packages Refs bsc#1149259 go1.13 release tracking
  • go#39925 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39848 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39823 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39697 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39561 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it tries to use an older version of dlv which only supports linux/amd64
  • go#39538 net: TestDialParallel is flaky on windows-amd64-longtest
  • go#39287 cmd/vet: update for new number formats
  • go#40211 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40209 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)
  • go#38932 runtime: preemption in startTemplateThread may cause infinite hang
  • go#36689 go/types, math/big: data race in go/types due to math/big.Rat accessors unsafe for concurrent use
• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the go1.13-1.13.15-2.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.14-1.14.15-1.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the terraform-provider-helm-2.0.0-1.4 package on the GA media of openSUSE Tumbleweed.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update for terraform fixes the following issues:

• Updated terraform to version 0.13.4 (bsc#1177421)

  • Many features, bug fixes, and enhancements were made during this update. Please refer to the terraform rpm changelog, for a full list of all changes.

• The following terraform providers were updated:

  • terraform-provider-aws
  • terraform-provider-azurerm
  • terraform-provider-external
  • terraform-provider-google
  • terraform-provider-helm
  • terraform-provider-kubernetes
  • terraform-provider-local
  • terraform-provider-null
  • terraform-provider-random
  • terraform-provider-tls