CVE-2022-28131

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

The Go Programming Language

Security Fix(es):

When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.(CVE-2022-32148)

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.(CVE-2022-30635)

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

Calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion.(CVE-2022-30633)

Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.(CVE-2022-30632)

Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.(CVE-2022-30631)

As required by RFC 8446, section 4.6.1, ticket_age_add now holds arandom 32-bit value. Before this change, this value was always setto 0.(CVE-2022-30629)

Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.(CVE-2022-28131)

Calling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion.(CVE-2022-1962)

The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a chunked encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.(CVE-2022-1705)

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Clean up dist-git patches (BZ#2110942)

• Update Go to version 1.17.12 (BZ#2110943)

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Clean up dist-git patches (BZ#2109174)

• Update Go to version 1.17.12 (BZ#2109183)

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)

Security Fix(es):

• sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)

• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

• grafana: XSS vulnerability in data source handling (CVE-2022-21702)

• grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)

• grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349)

Security Fix(es):

• sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)

• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

• grafana: XSS vulnerability in data source handling (CVE-2022-21702)

• grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)

• grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

• podman: symlink exchange attack in podman export volume (CVE-2023-0778)

• golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)

• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

• podman: symlink exchange attack in podman export volume (CVE-2023-0778)

• podman: possible information disclosure and modification (CVE-2022-2989)

• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es):

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• Clean up dist-git patches (BZ#2110942)
• Update Go to version 1.17.12 (BZ#2110943)

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fix(es):

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• Clean up dist-git patches (BZ#2109174)
• Update Go to version 1.17.12 (BZ#2109183)

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)

Security Fix(es):

• sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
• grafana: XSS vulnerability in data source handling (CVE-2022-21702)
• grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
• grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349)

Security Fix(es):

• sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
• grafana: XSS vulnerability in data source handling (CVE-2022-21702)
• grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
• grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
• podman: symlink exchange attack in podman export volume (CVE-2023-0778)
• golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)
• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
• podman: symlink exchange attack in podman export volume (CVE-2023-0778)
• podman: possible information disclosure and modification (CVE-2022-2989)
• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.

net/http: improper sanitization of Transfer-Encoding header The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid. (CVE-2022-1705)

When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected. (CVE-2022-32148)

compress/gzip: stack exhaustion in Reader.Read Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion. (CVE-2022-30631)

encoding/xml: stack exhaustion in Unmarshal Calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion. (CVE-2022-30633)

encoding/xml: stack exhaustion in Decoder.Skip Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion. (CVE-2022-28131)

encoding/gob: stack exhaustion in Decoder.Decode Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. (CVE-2022-30635)

path/filepath: stack exhaustion in Glob Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion. (CVE-2022-30632)

io/fs: stack exhaustion in Glob Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion. (CVE-2022-30630)

go/parser: stack exhaustion in all Parse* functions Calling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion. (CVE-2022-1962)

These are all security issues fixed in the go1.17-1.17.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.18-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.17 fixes the following issues:

Update to go version 1.17.13 (bsc#1190649):

• CVE-2022-32189: encoding/gob, math/big: decoding big.Float and big.Rat can panic (bsc#1202035).
• CVE-2022-30635: encoding/gob: stack exhaustion in Decoder.Decode (bsc#1201444).
• CVE-2022-30631: compress/gzip: stack exhaustion in Reader.Read (bsc#1201437).
• CVE-2022-1962: go/parser: stack exhaustion in all Parse* functions (bsc#1201448).
• CVE-2022-28131: encoding/xml: stack exhaustion in Decoder.Skip (bsc#1201443).
• CVE-2022-1705: net/http: improper sanitization of Transfer-Encoding header (bsc#1201434)
• CVE-2022-30630: io/fs: stack exhaustion in Glob (bsc#1201447).
• CVE-2022-32148: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (bsc#1201436)
• CVE-2022-30632: path/filepath: stack exhaustion in Glob (bsc#1201445).
• CVE-2022-30633: encoding/xml: stack exhaustion in Unmarshal (bsc#1201440).

This update for go1.18 fixes the following issues:

Update to go version 1.18.5 (bsc#1193742):

• CVE-2022-32189: encoding/gob, math/big: decoding big.Float and big.Rat can panic (bsc#1202035).
• CVE-2022-1705: net/http: improper sanitization of Transfer-Encoding header (bsc#1201434)
• CVE-2022-32148: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (bsc#1201436)
• CVE-2022-30631: compress/gzip: stack exhaustion in Reader.Read (bsc#1201437).
• CVE-2022-30633: encoding/xml: stack exhaustion in Unmarshal (bsc#1201440).
• CVE-2022-28131: encoding/xml: stack exhaustion in Decoder.Skip (bsc#1201443).
• CVE-2022-30635: encoding/gob: stack exhaustion in Decoder.Decode (bsc#1201444).
• CVE-2022-30632: path/filepath: stack exhaustion in Glob (bsc#1201445).
• CVE-2022-30630: io/fs: stack exhaustion in Glob (bsc#1201447).
• CVE-2022-1962: go/parser: stack exhaustion in all Parse* functions (bsc#1201448).

This update for go1.18-openssl fixes the following issues:

• Add subpackage go1.x-libstd compiled shared object libstd.so (jsc#PED-1962)

  • Main go1.x package included libstd.so in previous versions
  • Split libstd.so into subpackage that can be installed standalone
  • Continues the slimming down of main go1.x package by 40 Mb
  • Experimental and not recommended for general use, Go currently has no ABI
  • Upstream Go has not committed to support buildmode=shared long-term
  • Do not use in packaging, build static single binaries (the default)
  • Upstream Go go1.x binary releases do not include libstd.so
  • go1.x Suggests go1.x-libstd so not installed by default Recommends
  • go1.x-libstd does not Require: go1.x so can install standalone
  • Provides go-libstd unversioned package name
  • Fix build step -buildmode=shared std to omit -linkshared

• Packaging improvements:

  • go1.x Suggests go1.x-doc so not installed by default Recommends
  • Use Group: Development/Languages/Go instead of Other

• Improvements to go1.x packaging spec:

  • On Tumbleweed bootstrap with current default gcc13 and gccgo118
  • On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap using go1.x package (%bcond_without gccgo). This is no longer needed on current SLE-12:Update and removing will consolidate the build configurations used.
  • Change source URLs to go.dev as per Go upstream
  • On x86_64 export GOAMD64=v1 as per the current baseline. At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  • On x86_64 %define go_amd64=v1 as current instruction baseline

• Update to version 1.18.10.1 cut from the go1.18-openssl-fips branch at the revision tagged go1.18.10-1-openssl-fips.

  • Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  • Merge go1.18.10 into dev.boringcrypto.go1.18

• go1.18.10 (released 2023-01-10) includes fixes to cgo, the compiler, the linker, and the crypto/x509, net/http, and syscall packages. Refs bsc#1193742 go1.18 release tracking

  • go#57705 misc/cgo: backport needed for dlltool fix
  • go#57426 crypto/x509: Verify on macOS does not return typed errors
  • go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its 'old' argument.
  • go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  • go#57213 os: TestLstat failure on Linux Aarch64
  • go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  • go#57057 cmd/go: remove test dependency on gopkg.in service
  • go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  • go#57044 cgo: malformed DWARF TagVariable entry
  • go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  • go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  • go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  • go#56323 net/http: bad handling of HEAD requests with a body

It was discovered that the Go net/http module incorrectly handled Transfer-Encoding headers in the HTTP/1 client. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-1705)

It was discovered that Go did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2022-1962, CVE-2022-27664, CVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715, CVE-2022-41717, CVE-2023-24534, CVE-2023-24537)

It was discovered that Go did not properly implemented the maximum size of file headers in Reader.Read. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2022-2879)

It was discovered that the Go net/http module incorrectly handled query parameters in requests forwarded by ReverseProxy. A remote attacker could possibly use this issue to perform an HTTP Query Parameter Smuggling attack. (CVE-2022-2880)

It was discovered that Go did not properly manage the permissions for Faccessat function. A attacker could possibly use this issue to expose sensitive information. (CVE-2022-29526)

It was discovered that Go did not properly generate the values for ticket_age_add in session tickets. An attacker could possibly use this issue to observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. (CVE-2022-30629)

It was discovered that Go did not properly manage client IP addresses in net/http. An attacker could possibly use this issue to cause ReverseProxy to set the client IP as the value of the X-Forwarded-For header. (CVE-2022-32148)

It was discovered that Go did not properly validate backticks (`) as Javascript string delimiters, and do not escape them as expected. An attacker could possibly use this issue to inject arbitrary Javascript code into the Go template. (CVE-2023-24538)

USN-6038-1 fixed several vulnerabilities in Go 1.18. This update provides the corresponding updates for Go 1.13 and Go 1.16.

CVE-2022-29526 and CVE-2022-30630 only affected Go 1.16.

Original advisory details:

It was discovered that the Go net/http module incorrectly handled Transfer-Encoding headers in the HTTP/1 client. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-1705)

It was discovered that Go did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2022-1962, CVE-2022-27664, CVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715, CVE-2022-41717, CVE-2023-24534, CVE-2023-24537)

It was discovered that Go did not properly implemented the maximum size of file headers in Reader.Read. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2022-2879)

It was discovered that the Go net/http module incorrectly handled query parameters in requests forwarded by ReverseProxy. A remote attacker could possibly use this issue to perform an HTTP Query Parameter Smuggling attack. (CVE-2022-2880)

It was discovered that Go did not properly manage the permissions for Faccessat function. A attacker could possibly use this issue to expose sensitive information. (CVE-2022-29526)

It was discovered that Go did not properly generate the values for ticket_age_add in session tickets. An attacker could possibly use this issue to observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. (CVE-2022-30629)

It was discovered that Go did not properly manage client IP addresses in net/http. An attacker could possibly use this issue to cause ReverseProxy to set the client IP as the value of the X-Forwarded-For header. (CVE-2022-32148)

It was discovered that Go did not properly validate backticks (`) as Javascript string delimiters, and do not escape them as expected. An attacker could possibly use this issue to inject arbitrary Javascript code into the Go template. (CVE-2023-24538)