CVE-2023-39320

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

This update introduces go1.21, including fixes for the following issues:

• go1.21.3 (released 2023-10-10) includes a security fix to the net/http package. Refs boo#1212475 go1.21 release tracking CVE-2023-39325 CVE-2023-44487

  • go#63427 go#63417 boo#1216109 security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work

• go1.21.2 (released 2023-10-05) includes one security fixes to the cmd/go package, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the runtime/metrics package. Refs boo#1212475 go1.21 release tracking CVE-2023-39323

  • go#63214 go#63211 boo#1215985 security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build
  • go#62464 runtime: 'traceback did not unwind completely'
  • go#62478 runtime/metrics: /gc/scan* metrics return zero
  • go#62505 plugin: variable not initialized properly
  • go#62506 cmd/compile: internal compiler error: InvertFlags should never make it to codegen v100 = InvertFlags v123
  • go#62509 runtime: scheduler change causes Delve's function call injection to fail intermittently
  • go#62537 runtime: 'fatal: morestack on g0' with PGO enabled on arm64
  • go#62598 cmd/link: issues with Apple's new linker in Xcode 15 beta
  • go#62668 cmd/compile: slow to compile 17,000 line switch statement?
  • go#62711 cmd/go: TestScript/gotoolchain_path fails if golang.org/dl/go1.21.1 is installed in the user's $PATH

• go1.21.1 (released 2023-09-06) includes four security fixes to the cmd/go, crypto/tls, and html/template packages, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the context, crypto/tls, encoding/gob, encoding/xml, go/types, net/http, os, and path/filepath packages. Refs boo#1212475 go1.21 release tracking CVE-2023-39318 CVE-2023-39319 CVE-2023-39320 CVE-2023-39321 CVE-2023-39322

  • go#62290 go#62266 boo#1215087 security: fix CVE-2023-39321 CVE-2023-39322 crypto/tls: panic when processing partial post-handshake message in QUICConn.HandleData
  • go#62394 go#62198 boo#1215086 security: fix CVE-2023-39320 cmd/go: go.mod toolchain directive allows arbitrary execution
  • go#62396 go#62196 boo#1215084 security: fix CVE-2023-39318 html/template: improper handling of HTML-like comments within script contexts
  • go#62398 go#62197 boo#1215085 security: fix CVE-2023-39319 html/template: improper handling of special tags within script contexts
  • go#61743 go/types: interface.Complete panics for interfaces with duplicate methods
  • go#61781 cmd/compile: internal compiler error: 'f': value .autotmp_1 (nil) incorrectly live at entry
  • go#61818 cmd/go: panic: runtime error: index out of range [-1] in collectDepsErrors
  • go#61821 runtime/internal/wasitest: TestTCPEcho is racy
  • go#61868 path/filepath: Clean on some invalid Windows paths can lose .. components
  • go#61904 net/http: go 1.20.6 host validation breaks setting Host to a unix socket address
  • go#61905 cmd/go: go get/mod tidy panics with internal error: net token acquired but not released
  • go#61909 cmd/compile: internal compiler error: missed typecheck
  • go#61910 os: ReadDir fails on file systems without File ID support on Windows
  • go#61927 cmd/distpack: release archives don't include directory members
  • go#61930 spec, go/types, types2: restore Go 1.20 unification when compiling for Go 1.20
  • go#61932 go/types, types2: index out of range panic in Checker.arguments
  • go#61958 cmd/compile: write barrier code is sometimes preemptible when compiled with -N
  • go#61959 go/types, types2: panic: infinite recursion in unification with go1.21.0
  • go#61964 os: ReadDir(\.\pipe) fails with go1.21 on Windows
  • go#61967 crypto/tls: add GODEBUG to control max RSA key size
  • go#61987 runtime: simple programs crash on linux/386 with go1.21 when build with -gcflags='all=-N -l'
  • go#62019 runtime: execution halts with goroutines stuck in runtime.gopark…

These are all security issues fixed in the go1.21-1.21.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.21 fixes the following issues:

Update to go1.21.1 (bsc#1212475).

• CVE-2023-39318: Fixed improper handling of HTML-like comments within script contexts in html/template (bsc#1215084).
• CVE-2023-39319: Fixed improper handling of special tags within script contexts in html/template (bsc#1215085).
• CVE-2023-39320: Fixed arbitrary execution in go.mod toolchain directive (bsc#1215086).
• CVE-2023-39321, CVE-2023-39322: Fixed a panic when processing post-handshake message on QUIC connections in crypto/tls (bsc#1215087).

The following non-security bug was fixed:

• Add missing directory pprof html asset directory to package (bsc#1215090).

This update for go1.21-openssl fixes the following issues:

Update to version 1.21.4.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.4-1-openssl-fips.

• Update to go1.21.4

go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages.

• security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
• spec: update unification rules
• cmd/compile: internal compiler error: expected struct value to have type struct
• cmd/link: split text sections for arm 32-bit
• runtime: MADV_COLLAPSE causes production performance issues on Linux
• go/types, x/tools/go/ssa: panic: type param without replacement encountered
• cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64
• net/http: http2 page fails on firefox/safari if pushing resources

Initial package go1.21-openssl version 1.21.3.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.3-1-openssl-fips. (jsc#SLE-18320)

• Go upstream merged branch dev.boringcrypto in go1.19+.
• In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.
• In go1.x-openssl enable FIPS mode (or boring mode as the package is named) either via an environment variable GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.
• When the operating system is operating in FIPS mode, Go applications which import crypto/tls/fipsonly limit operations to the FIPS ciphersuite.
• go1.x-openssl is delivered as two large patches to go1.x applying necessary modifications from the golang-fips/go GitHub project for the Go crypto library to use OpenSSL as the external cryptographic library in a FIPS compliant way.
• go1.x-openssl modifies the crypto/* packages to use OpenSSL for cryptographic operations.
• go1.x-openssl uses dlopen() to call into OpenSSL.
• SUSE RPM packaging introduces a fourth version digit go1.x.y.z corresponding to the golang-fips/go patchset tagged revision.
• Patchset improvements can be updated independently of upstream Go maintenance releases.