CVE-2020-15586

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

HTTP servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected.

Servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected (CVE-2020-15586).

Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This could lead to processing more input than expected when the caller is reading directly from the network and depends on ReadUvarint and ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs (CVE-2020-16845).

The golang package has been updated to version 1.13.15, fixing these issues and containing several other bug fixes and enhancements. See the 1.13 release notes and other references for details.

This update for go1.13 fixes the following issues:

• go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the database/sql, net/http, and reflect packages Refs bsc#1149259 go1.13 release tracking
  • go#39925 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39848 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39823 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39697 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39561 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it tries to use an older version of dlv which only supports linux/amd64
  • go#39538 net: TestDialParallel is flaky on windows-amd64-longtest
  • go#39287 cmd/vet: update for new number formats
  • go#40211 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40209 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)
  • go#38932 runtime: preemption in startTemplateThread may cause infinite hang
  • go#36689 go/types, math/big: data race in go/types due to math/big.Rat accessors unsafe for concurrent use
• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.13 fixes the following issues:

• go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the database/sql, net/http, and reflect packages Refs bsc#1149259 go1.13 release tracking
  • go#39925 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39848 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39823 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39697 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39561 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it tries to use an older version of dlv which only supports linux/amd64
  • go#39538 net: TestDialParallel is flaky on windows-amd64-longtest
  • go#39287 cmd/vet: update for new number formats
  • go#40211 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40209 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)
  • go#38932 runtime: preemption in startTemplateThread may cause infinite hang
  • go#36689 go/types, math/big: data race in go/types due to math/big.Rat accessors unsafe for concurrent use
• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the go1.13-1.13.15-2.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.14-1.14.15-1.6 package on the GA media of openSUSE Tumbleweed.

This update for go1.14 fixes the following issues:

• go1.14 was updated to version 1.14.7

• CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).

• go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191

  • go#39991 runtime: missing deferreturn on linux/ppc64le
  • go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent
  • go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes
  • go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15
  • go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally
  • go#39636 reflect: DeepEqual can return true for values that are not equal
  • go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues
  • go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64
  • go#39308 testing: streaming output loses parallel subtest associations
  • go#39288 cmd/vet: update for new number formats
  • go#39101 database/sql: context cancellation allows statements to execute after rollback
  • go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes
  • go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586
  • go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)

• Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305