CVE-2024-24787

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

These are all security issues fixed in the go1.22-1.22.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.21-1.21.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.22 fixes the following issues:

Update to go1.22.3:

• CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin (bsc#1224017)
• CVE-2024-24788: net: high cpu usage in extractExtendedRCode (bsc#1224018)
• cmd/compile: Go 1.22.x failed to be bootstrapped from 386 to ppc64le
• cmd/compile: changing a hot concrete method to interface method triggers a PGO ICE
• runtime: deterministic fallback hashes across process boundary
• net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]

This update for go1.21 fixes the following issues:

Update to go1.21.10:

• CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin (bsc#1224017)
• net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]

This update for go1.22 fixes the following issues:

Update to go1.22.3:

• CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin (bsc#1224017)
• CVE-2024-24788: net: high cpu usage in extractExtendedRCode (bsc#1224018)
• cmd/compile: Go 1.22.x failed to be bootstrapped from 386 to ppc64le
• cmd/compile: changing a hot concrete method to interface method triggers a PGO ICE
• runtime: deterministic fallback hashes across process boundary
• net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]

This update for go1.21 fixes the following issues:

Update to go1.21.10:

• CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin (bsc#1224017)
• net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]

This update for go1.21-openssl fixes the following issues:

• CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)
• CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
• CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)
• CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000)
• CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
• CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)
• CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
• CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)

Other fixes:

• Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
• Update to version 1.21.13 (bsc#1212475)
• Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
• Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

This update for go1.21-openssl fixes the following issues:

• CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)
• CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
• CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)
• CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000)
• CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
• CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)
• CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
• CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)

Other fixes:

• Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
• Update to version 1.21.13 (bsc#1212475)
• Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
• Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

This update for go1.22-openssl fixes the following issues:

This update ships go1.22-openssl 1.22.7.1 (jsc#SLE-18320)

• Update to version 1.22.7.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.7-1-openssl-fips.

  • Update to Go 1.22.7 (#229)

• go1.22.7 (released 2024-09-05) includes security fixes to the encoding/gob, go/build/constraint, and go/parser packages, as well as bug fixes to the fix command and the runtime.

  CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:

  • go#69142 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)
  • go#69144 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)
  • go#69148 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)
  • go#68811 os: TestChtimes failures
  • go#68825 cmd/fix: fails to run on modules whose go directive value is in '1.n.m' format introduced in Go 1.21.0
  • go#68972 cmd/cgo: aix c-archive corrupting stack

• go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler, the linker, the trace command, the covdata command, and the bytes, go/types, and os/exec packages.

  • go#68594 cmd/compile: internal compiler error with zero-size types
  • go#68546 cmd/trace/v2: pprof profiles always empty
  • go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop
  • go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm
  • go#68370 go/types: assertion failure in recent range statement checking logic
  • go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows
  • go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race
  • go#68222 cmd/go: list with -export and -covermode=atomic fails to build
  • go#68198 cmd/link: issues with Xcode 16 beta

• Update to version 1.22.5.3 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-3-openssl-fips.

  • Only load openssl if fips == '1' Avoid loading openssl whenever GOLANG_FIPS is not 1. Previously only an unset variable would cause the library load to be skipped, but users may also expect to be able to set eg. GOLANG_FIPS=0 in environments without openssl.

• Update to version 1.22.5.2 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-2-openssl-fips.

  • Only load OpenSSL when in FIPS mode

• Update to version 1.22.5.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-1-openssl-fips.

  • Update to go1.22.5

• go1.22.5 (released 2024-07-02) includes security fixes to the net/http package, as well as bug fixes to the compiler, cgo, the go command, the linker, the runtime, and the crypto/tls, go/types, net, net/http, and os/exec packages.

  CVE-2024-24791:

  • go#68200 go#67555 bsc#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways
  • go#65983 cmd/compile: hash of unhashable type
  • go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()
  • go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without '.exe' no longer implicitly adds '.exe' in Go 1.22
  • go#67298 runtime: 'fatal: morestack on g0' on amd64 after upgrade to Go 1.21, stale bounds
  • go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders
  • go#67798 cmd/compile: internal compiler error: unexpected type: <nil> (<nil>) in for-range
  • go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec
  • go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0
  • go#67934 net: go DNS resolver fails to connect to local DNS server
  • go#67945 cmd/link: using -fuzz…

This update for go1.22-openssl fixes the following issues:

This update ships go1.22-openssl 1.22.7.1 (jsc#SLE-18320)

• Update to version 1.22.7.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.7-1-openssl-fips.

  • Update to Go 1.22.7 (#229)

• go1.22.7 (released 2024-09-05) includes security fixes to the encoding/gob, go/build/constraint, and go/parser packages, as well as bug fixes to the fix command and the runtime.

  CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:

  • go#69142 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)
  • go#69144 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)
  • go#69148 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)
  • go#68811 os: TestChtimes failures
  • go#68825 cmd/fix: fails to run on modules whose go directive value is in '1.n.m' format introduced in Go 1.21.0
  • go#68972 cmd/cgo: aix c-archive corrupting stack

• go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler, the linker, the trace command, the covdata command, and the bytes, go/types, and os/exec packages.

  • go#68594 cmd/compile: internal compiler error with zero-size types
  • go#68546 cmd/trace/v2: pprof profiles always empty
  • go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop
  • go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm
  • go#68370 go/types: assertion failure in recent range statement checking logic
  • go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows
  • go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race
  • go#68222 cmd/go: list with -export and -covermode=atomic fails to build
  • go#68198 cmd/link: issues with Xcode 16 beta

• Update to version 1.22.5.3 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-3-openssl-fips.

  • Only load openssl if fips == '1' Avoid loading openssl whenever GOLANG_FIPS is not 1. Previously only an unset variable would cause the library load to be skipped, but users may also expect to be able to set eg. GOLANG_FIPS=0 in environments without openssl.

• Update to version 1.22.5.2 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-2-openssl-fips.

  • Only load OpenSSL when in FIPS mode

• Update to version 1.22.5.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-1-openssl-fips.

  • Update to go1.22.5

• go1.22.5 (released 2024-07-02) includes security fixes to the net/http package, as well as bug fixes to the compiler, cgo, the go command, the linker, the runtime, and the crypto/tls, go/types, net, net/http, and os/exec packages.

  CVE-2024-24791:

  • go#68200 go#67555 bsc#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways
  • go#65983 cmd/compile: hash of unhashable type
  • go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()
  • go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without '.exe' no longer implicitly adds '.exe' in Go 1.22
  • go#67298 runtime: 'fatal: morestack on g0' on amd64 after upgrade to Go 1.21, stale bounds
  • go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders
  • go#67798 cmd/compile: internal compiler error: unexpected type: <nil> (<nil>) in for-range
  • go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec
  • go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0
  • go#67934 net: go DNS resolver fails to connect to local DNS server
  • go#67945 cmd/link: using -fuzz…