CVE-2023-39323

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

.

Security Fix(es):

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.(CVE-2023-39318)

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.(CVE-2023-39319)

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.(CVE-2023-39323)

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.(CVE-2023-39325)

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

This update introduces go1.21, including fixes for the following issues:

• go1.21.3 (released 2023-10-10) includes a security fix to the net/http package. Refs boo#1212475 go1.21 release tracking CVE-2023-39325 CVE-2023-44487

  • go#63427 go#63417 boo#1216109 security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work

• go1.21.2 (released 2023-10-05) includes one security fixes to the cmd/go package, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the runtime/metrics package. Refs boo#1212475 go1.21 release tracking CVE-2023-39323

  • go#63214 go#63211 boo#1215985 security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build
  • go#62464 runtime: 'traceback did not unwind completely'
  • go#62478 runtime/metrics: /gc/scan* metrics return zero
  • go#62505 plugin: variable not initialized properly
  • go#62506 cmd/compile: internal compiler error: InvertFlags should never make it to codegen v100 = InvertFlags v123
  • go#62509 runtime: scheduler change causes Delve's function call injection to fail intermittently
  • go#62537 runtime: 'fatal: morestack on g0' with PGO enabled on arm64
  • go#62598 cmd/link: issues with Apple's new linker in Xcode 15 beta
  • go#62668 cmd/compile: slow to compile 17,000 line switch statement?
  • go#62711 cmd/go: TestScript/gotoolchain_path fails if golang.org/dl/go1.21.1 is installed in the user's $PATH

• go1.21.1 (released 2023-09-06) includes four security fixes to the cmd/go, crypto/tls, and html/template packages, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the context, crypto/tls, encoding/gob, encoding/xml, go/types, net/http, os, and path/filepath packages. Refs boo#1212475 go1.21 release tracking CVE-2023-39318 CVE-2023-39319 CVE-2023-39320 CVE-2023-39321 CVE-2023-39322

  • go#62290 go#62266 boo#1215087 security: fix CVE-2023-39321 CVE-2023-39322 crypto/tls: panic when processing partial post-handshake message in QUICConn.HandleData
  • go#62394 go#62198 boo#1215086 security: fix CVE-2023-39320 cmd/go: go.mod toolchain directive allows arbitrary execution
  • go#62396 go#62196 boo#1215084 security: fix CVE-2023-39318 html/template: improper handling of HTML-like comments within script contexts
  • go#62398 go#62197 boo#1215085 security: fix CVE-2023-39319 html/template: improper handling of special tags within script contexts
  • go#61743 go/types: interface.Complete panics for interfaces with duplicate methods
  • go#61781 cmd/compile: internal compiler error: 'f': value .autotmp_1 (nil) incorrectly live at entry
  • go#61818 cmd/go: panic: runtime error: index out of range [-1] in collectDepsErrors
  • go#61821 runtime/internal/wasitest: TestTCPEcho is racy
  • go#61868 path/filepath: Clean on some invalid Windows paths can lose .. components
  • go#61904 net/http: go 1.20.6 host validation breaks setting Host to a unix socket address
  • go#61905 cmd/go: go get/mod tidy panics with internal error: net token acquired but not released
  • go#61909 cmd/compile: internal compiler error: missed typecheck
  • go#61910 os: ReadDir fails on file systems without File ID support on Windows
  • go#61927 cmd/distpack: release archives don't include directory members
  • go#61930 spec, go/types, types2: restore Go 1.20 unification when compiling for Go 1.20
  • go#61932 go/types, types2: index out of range panic in Checker.arguments
  • go#61958 cmd/compile: write barrier code is sometimes preemptible when compiled with -N
  • go#61959 go/types, types2: panic: infinite recursion in unification with go1.21.0
  • go#61964 os: ReadDir(\.\pipe) fails with go1.21 on Windows
  • go#61967 crypto/tls: add GODEBUG to control max RSA key size
  • go#61987 runtime: simple programs crash on linux/386 with go1.21 when build with -gcflags='all=-N -l'
  • go#62019 runtime: execution halts with goroutines stuck in runtime.gopark…

These are all security issues fixed in the go1.20-1.20.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.21-1.21.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.21 fixes the following issues:

• Updated to version 1.21.2 (bsc#1212475):

  • CVE-2023-39323: Fixed an arbitrary execution issue during build time due to path directive bypass (bsc#1215985).

This update for go1.20 fixes the following issues:

• Updated to version 1.20.9 (bsc#1206346):

  • CVE-2023-39323: Fixed an arbitrary execution issue during build time due to path directive bypass (bsc#1215985).

This update for go1.21-openssl fixes the following issues:

Update to version 1.21.4.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.4-1-openssl-fips.

• Update to go1.21.4

go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages.

• security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
• spec: update unification rules
• cmd/compile: internal compiler error: expected struct value to have type struct
• cmd/link: split text sections for arm 32-bit
• runtime: MADV_COLLAPSE causes production performance issues on Linux
• go/types, x/tools/go/ssa: panic: type param without replacement encountered
• cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64
• net/http: http2 page fails on firefox/safari if pushing resources

Initial package go1.21-openssl version 1.21.3.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.3-1-openssl-fips. (jsc#SLE-18320)

• Go upstream merged branch dev.boringcrypto in go1.19+.
• In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.
• In go1.x-openssl enable FIPS mode (or boring mode as the package is named) either via an environment variable GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.
• When the operating system is operating in FIPS mode, Go applications which import crypto/tls/fipsonly limit operations to the FIPS ciphersuite.
• go1.x-openssl is delivered as two large patches to go1.x applying necessary modifications from the golang-fips/go GitHub project for the Go crypto library to use OpenSSL as the external cryptographic library in a FIPS compliant way.
• go1.x-openssl modifies the crypto/* packages to use OpenSSL for cryptographic operations.
• go1.x-openssl uses dlopen() to call into OpenSSL.
• SUSE RPM packaging introduces a fourth version digit go1.x.y.z corresponding to the golang-fips/go patchset tagged revision.
• Patchset improvements can be updated independently of upstream Go maintenance releases.

This update for go1.20-openssl fixes the following issues:

Update to version 1.20.11.1 cut from the go1.20-openssl-fips branch at the revision tagged go1.20.11-1-openssl-fips.

• Update to go1.20.11

go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package.

• security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
• cmd/link: split text sections for arm 32-bit
• net/http: http2 page fails on firefox/safari if pushing resources

Update to version 1.20.10.1 cut from the go1.20-openssl-fips branch at the revision tagged go1.20.10-1-openssl-fips.

• Update to go1.20.10

go1.20.10 (released 2023-10-10) includes a security fix to the net/http package.

• security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work (bsc#1216109)

go1.20.9 (released 2023-10-05) includes one security fixes to the cmd/go package, as well as bug fixes to the go command and the linker.

• security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build (bsc#1215985)
• cmd/link: issues with Apple's new linker in Xcode 15 beta

Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross site scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-39318, CVE-2023-39319)

It was discovered that Go did not properly validate the "//go:cgo_" directives during compilation. An attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323)

It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the net/http module. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-39325, CVE-2023-44487)

It was discovered that the Go net/http module did not properly validate the chunk extensions reading from a request or response body. An attacker could possibly use this issue to read sensitive information. (CVE-2023-39326)

It was discovered that Go did not properly validate the insecure "git://" protocol when using go get to fetch a module with the ".git" suffix. An attacker could possibly use this issue to bypass secure protocol checks. (CVE-2023-45285)

Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-41723)

Marten Seemann discovered that Go did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41724)

Ameya Darshan and Jakob Ackermann discovered that Go did not properly validate the amount of memory and disk files ReadForm can consume. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41725)

Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An attacker could possibly use this issue to run arbitrary commands. (CVE-2023-24531)

Jakob Ackermann discovered that Go incorrectly handled multipart forms. An attacker could possibly use this issue to consume an excessive amount of resources, resulting in a denial of service. (CVE-2023-24536)

Juho Nurminen discovered that Go incorrectly handled certain special characters in directory or file paths. An attacker could possibly use this issue to inject code into the resulting binaries. (CVE-2023-29402)

Vincent Dehors discovered that Go incorrectly handled permission bits. An attacker could possibly use this issue to read or write files with elevated privileges. (CVE-2023-29403)

Juho Nurminen discovered that Go incorrectly handled certain compiler directives. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-29404)

Juho Nurminen discovered that Go incorrectly handled certain crafted arguments. An attacker could possibly use this issue to execute arbitrary code at build time. (CVE-2023-29405)

Bartek Nowotarski discovered that Go incorrectly validated the contents of host headers. A remote attacker could possibly use this issue to inject additional headers or entire requests. (CVE-2023-29406)

Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)

It was discovered that Go did not properly validate the "//go:cgo_" directives during compilation. An attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323)

It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the net/http module. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2023-39325)

Bartek Nowotarski was discovered that the Go net/http module did not properly handle the requests when request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-45288)

Bartek Nowotarski discovered that the Go net/http module did not properly validate the total size of the parsed form when parsing a multipart form. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-45290)

John Howard discovered that the Go crypto/x509 module did not properly handle a certificate chain which contains a certificate with an unknown public key algorithm. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24783)

Juho Nurminen discovered that the Go net/mail module did not properly handle comments within display names in the ParseAddressList function. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24784)

It was discovered that the Go html/template module did not validate errors returned from MarshalJSON methods. An attacker could possibly use this issue to inject arbitrary code into the Go template. (CVE-2024-24785)

Yufan You discovered that the Go archive/zip module…

Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-41723)

Marten Seemann discovered that Go did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41724)

Ameya Darshan and Jakob Ackermann discovered that Go did not properly validate the amount of memory and disk files ReadForm can consume. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41725)

Jakob Ackermann discovered that Go incorrectly handled multipart forms. An attacker could possibly use this issue to consume an excessive amount of resources, resulting in a denial of service. (CVE-2023-24536)

It was discovered that Go did not properly validate the "//go:cgo_" directives during compilation. An attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323)

Bartek Nowotarski was discovered that the Go net/http module did not properly handle the requests when request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-45288)

Bartek Nowotarski discovered that the Go net/http module did not properly validate the total size of the parsed form when parsing a multipart form. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-45290)

John Howard discovered that the Go crypto/x509 module did not properly handle a certificate chain which contains a certificate with an unknown public key algorithm. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24783)

Juho Nurminen discovered that the Go net/mail module did not properly handle comments within display names in the ParseAddressList function. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24784)

Yufan You discovered that the Go archive/zip module did not properly handle certain types of invalid zip files differs from the behavior of most zip implementations. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24789)

Geoff Franks discovered that the Go net/http module did not properly handle responses to requests with an "Expect: 100-continue" header under certain circumstances. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-24791)

It was discovered that the Go parser module did not properly handle deeply nested literal values. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34155)

Md Sakib Anwar discovered that the Go encoding/gob module did not properly handle message decoding under certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34156)

It was discovered that the Go build module did not properly handle certain build tag lines with deeply nested expressions. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34158)