CVE-2023-45284

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

On Windows, The IsLocal function does not correctly detect reserved device names in some cases.

Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local.

With fix, IsLocal now correctly reports these names as non-local.

These are all security issues fixed in the go1.20-1.20.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.21-1.21.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the traefik-2.10.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the traefik2-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.21-openssl fixes the following issues:

Update to version 1.21.4.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.4-1-openssl-fips.

• Update to go1.21.4

go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages.

• security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
• spec: update unification rules
• cmd/compile: internal compiler error: expected struct value to have type struct
• cmd/link: split text sections for arm 32-bit
• runtime: MADV_COLLAPSE causes production performance issues on Linux
• go/types, x/tools/go/ssa: panic: type param without replacement encountered
• cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64
• net/http: http2 page fails on firefox/safari if pushing resources

Initial package go1.21-openssl version 1.21.3.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.3-1-openssl-fips. (jsc#SLE-18320)

• Go upstream merged branch dev.boringcrypto in go1.19+.
• In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.
• In go1.x-openssl enable FIPS mode (or boring mode as the package is named) either via an environment variable GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.
• When the operating system is operating in FIPS mode, Go applications which import crypto/tls/fipsonly limit operations to the FIPS ciphersuite.
• go1.x-openssl is delivered as two large patches to go1.x applying necessary modifications from the golang-fips/go GitHub project for the Go crypto library to use OpenSSL as the external cryptographic library in a FIPS compliant way.
• go1.x-openssl modifies the crypto/* packages to use OpenSSL for cryptographic operations.
• go1.x-openssl uses dlopen() to call into OpenSSL.
• SUSE RPM packaging introduces a fourth version digit go1.x.y.z corresponding to the golang-fips/go patchset tagged revision.
• Patchset improvements can be updated independently of upstream Go maintenance releases.

This update for go1.20 fixes the following issues:

go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package.

• security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
• cmd/link: split text sections for arm 32-bit
• net/http: http2 page fails on firefox/safari if pushing resources

This update for go1.21 fixes the following issues:

go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages.

• security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
• spec: update unification rules
• cmd/compile: internal compiler error: expected struct value to have type struct
• cmd/link: split text sections for arm 32-bit
• runtime: MADV_COLLAPSE causes production performance issues on Linux
• go/types, x/tools/go/ssa: panic: type param without replacement encountered
• cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64
• net/http: http2 page fails on firefox/safari if pushing resources

This update for go1.20-openssl fixes the following issues:

Update to version 1.20.11.1 cut from the go1.20-openssl-fips branch at the revision tagged go1.20.11-1-openssl-fips.

• Update to go1.20.11

go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package.

• security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
• cmd/link: split text sections for arm 32-bit
• net/http: http2 page fails on firefox/safari if pushing resources

Update to version 1.20.10.1 cut from the go1.20-openssl-fips branch at the revision tagged go1.20.10-1-openssl-fips.

• Update to go1.20.10

go1.20.10 (released 2023-10-10) includes a security fix to the net/http package.

• security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work (bsc#1216109)

go1.20.9 (released 2023-10-05) includes one security fixes to the cmd/go package, as well as bug fixes to the go command and the linker.

• security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build (bsc#1215985)
• cmd/link: issues with Apple's new linker in Xcode 15 beta

This update for go1.20 fixes the following issues:

Update to go1.20.12:

• CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).
• CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).
• CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).
• cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents
• cmd/go: TestScript/mod_get_direct fails with 'Filename too long' on Windows

This update for go1.21 fixes the following issues:

Update to go1.21.5:

• CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).
• CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).
• CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).
• cmd/go: go mod download needs to support toolchain upgrades
• cmd/compile: invalid pointer found on stack when compiled with -race
• os: NTFS deduped file changed from regular to irregular
• net: TCPConn.ReadFrom hangs when io.Reader is TCPConn or UnixConn, Linux kernel < 5.1
• cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents
• syscall: TestOpenFileLimit unintentionally runs on non-Unix platforms
• runtime: self-deadlock on mheap_.lock
• crypto/rand: Legacy RtlGenRandom use on Windows

This update for go1.20-openssl fixes the following issues:

Update to version 1.20.12.1:

• CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).
• CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).
• CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).
• cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents
• cmd/go: TestScript/mod_get_direct fails with 'Filename too long' on Windows

This update for go1.21-openssl fixes the following issues:

Update to version 1.21.5.1:

• CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).
• CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).
• CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).
• cmd/go: go mod download needs to support toolchain upgrades
• cmd/compile: invalid pointer found on stack when compiled with -race
• os: NTFS deduped file changed from regular to irregular
• net: TCPConn.ReadFrom hangs when io.Reader is TCPConn or UnixConn, Linux kernel < 5.1
• cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents
• syscall: TestOpenFileLimit unintentionally runs on non-Unix platforms
• runtime: self-deadlock on mheap_.lock
• crypto/rand: Legacy RtlGenRandom use on Windows