CVE-2022-24921

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

The Go Programming Language.

Security Fix(es):

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.(CVE-2022-24921)

%{expand:

Security Fix(es):

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.(CVE-2022-24675)

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.(CVE-2022-24921)

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.(CVE-2022-28327)

%{expand:

Security Fix(es):

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.(CVE-2022-24675)

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.(CVE-2022-24921)

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.(CVE-2022-28327)

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)

• golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)

• golang: syscall: faccessat checks wrong group (CVE-2022-29526)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Update to Go 1.17.10 (BZ#2091077)

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Clean up dist-git patches (BZ#2109174)

• Update Go to version 1.17.12 (BZ#2109183)

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB.

On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB. (CVE-2022-24921)

These are all security issues fixed in the go1.16-1.16.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.17-1.17.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.16 fixes the following issues:

Update to version 1.16.15 (bsc#1182345):

• CVE-2022-24921: Fixed a potential denial of service via large regular expressions (bsc#1196732).

Non-security fixes:

• Fixed an issue with v2 modules (go#51331).
• Fixed an issue when building source in riscv64 (go#51198).
• Increased compatibility for the DNS protocol in the net module (go#51161).
• Fixed an issue with histograms in the runtime/metrics module (go#50733).

This update for go1.17 fixes the following issues:

Update to version 1.17.8 (bsc#1190649):

• CVE-2022-24921: Fixed a potential denial of service via large regular expressions (bsc#1196732).

Non-security fixes:

• Fixed an issue with v2 modules (go#51332).
• Fixed an issue when building source in riscv64 (go#51199).
• Increased compatibility for the DNS protocol in the net module (go#51162).
• Fixed an issue with histograms in the runtime/metrics module (go#50734).
• Fixed an issue when parsing x509 certificates (go#51000).