CVE-2021-44717

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

The Go Programming Language.

Security Fix(es):

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.(CVE-2021-44717)

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.(CVE-2022-24675)

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.(CVE-2022-28327)

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: net/http: limit growth of header canonicalization cache (CVE-2021-44716)

• golang: syscall: don't close fd 0 on ForkExec error (CVE-2021-44717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rebase Go to 1.16.12 (BZ#2031125)

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: net/http: limit growth of header canonicalization cache (CVE-2021-44716)

• golang: syscall: don't close fd 0 on ForkExec error (CVE-2021-44717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rebase Go to 1.16.12 (BZ#2031125)

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

When a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec (including indirectly by using the os/exec package), syscall.ForkExec can close file descriptor 0 as it fails. If this happens (or can be provoked) repeatedly, it can result in misdirected I/O such as writing network traffic intended for one connection to a different connection, or content intended for one file to a different one.

For users who cannot immediately update to the new release, the bug can be mitigated by raising the per-process file descriptor limit.

net/http: limit growth of header canonicalization cache (CVE-2021-44716) syscall: don't close fd 0 on ForkExec error (CVE-2021-44717)

This update for go1.16 fixes the following issues:

Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345)

• CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598).
• CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597).

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.16 fixes the following issues:

Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345)

• CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598).
• CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597).

This update for go1.17 fixes the following issues:

Updated to upstream version 1.17.5 to include fixes to the compiler, linker, syscall, runtime, the net/http, go/types, and time packages (bsc#1190649)

• CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598).
• CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597).

This update for apptainer fixes the following issues:

Updated to 1.1.2 which fixed CVE-2022-39237

• CVE-2022-39237: The sif dependency included in Apptainer before this release does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. This release updates to sif v2.8.1 which corrects this issue. See the linked advisory for references and a workaround.

Updated to version 1.1.0

• added squashfuse-0.1.105.tar.gz and 70.patch for the build of squashfuse_ll which will be removed as soon as the multithread patch is incoperated
• Change squash mounts to prefer to use squashfuse_ll instead of squashfuse, if available, for improved performance. squashfuse_ll is not available in factory.
• Also, for even better parallel performance, include a patched multithreaded version of squashfuse_ll in
• Imply adding ${prefix}/libexec/apptainer/bin to the binary path in apptainer.conf, which is used for searching for helper executables. It is implied as the first directory of $PATH if present (which is at the beginning of binary path by default) or just as the first directory if $PATH is not included in binary path. ${prefix}/libexec/apptainer/bin.
• Add --unsquash action flag to temporarily convert a SIF file to a sandbox before running. In previous versions this was the default when running a SIF file without setuid or with fakeroot, but now the default is to instead mount with squashfuse.
• Add --sparse flag to overlay create command to allow generation of a sparse ext3 overlay image.
• Support for a custom hashbang in the %test section of an Apptainer recipe (akin to the runscript and start sections).
• When using fakeroot in setuid mode, have the image drivers first enter the the container's user namespace to avoid write errors with overlays.
• Skip trying to use kernel overlayfs when using writable overlay and the lower layer is FUSE, because of a kernel bug introduced in kernel 5.15.
• Add additional hidden options to the action command for testing different fakeroot modes with --fakeroot: --ignore-subuid, --ignore-fakeroot-command, and --ignore-userns.

• Updated to version 1.1.0-rc2 with following changes:

  • Fixed longstanding bug in the underlay logic when there are nested bind points separated by more than one path level, for example /var and /var/lib/yum, and the path didn't exist in the container image. The bug only caused an error when there was a directory in the container image that didn't exist on the host.
  • Improved wildcard matching in the %files directive of build definition files by replacing usage of sh with the mvdan.cc library.
  • Replaced checks for compatible filesystem types when using fuse-overlayfs with an INFO message when an incompatible filesystem type causes it to be unwritable by a fakeroot user.
  • The --nvccli option now works without --fakeroot. In that case the option can be used with --writable-tmpfs instead of --writable, and --writable-tmpfs is implied if neither option is given. Note that also /usr/bin has to be writable by the user, so without --fakeroot that probably requires a sandbox image that was built with --fix-perms.
  • The --nvccli option implies --nv.
  • Configure squashfuse to always show files to be owned by the current user. That's especially important for fakeroot to prevent most of the files from looking like they are owned by user 65534.
  • The fakeroot command can now be used even if $PATH is empty in the environment of the apptainer command.
  • Allow the newuidmap command to be missing if the current user is not listed in /etc/subuid.
  • Require the uidmap package in Debian packaging.
  • Improved error handling of unsupported pass protected PEM files with encrypted containers.
  • Ensure bootstrap_history directory is populated with previous…

These are all security issues fixed in the go1.16-1.16.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.17-1.17.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apptainer-1.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.16 fixes the following issues:

Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345)

• CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598).
• CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597).

This update for go1.17 fixes the following issues:

Updated to upstream version 1.17.5 to include fixes to the compiler, linker, syscall, runtime, the net/http, go/types, and time packages (bsc#1190649)

• CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598).
• CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597).