CVE-2024-34155

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

.

Security Fix(es):

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.(CVE-2024-34155)

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.(CVE-2024-34158)

.

Security Fix(es):

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.(CVE-2024-34155)

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.(CVE-2024-34158)

.

Security Fix(es):

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.(CVE-2024-34155)

.

Security Fix(es):

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.(CVE-2024-34155)

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.(CVE-2024-34158)

.

Security Fix(es):

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.(CVE-2024-34155)

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.(CVE-2024-34156)

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.(CVE-2024-34158)

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
• Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
• Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
• Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)
• Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
• Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
• Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)
• Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
• Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

• Update to Go 1.22.9
• Remove CVE-2024-34155, CVE-2024-34156, and CVE-2024-34158 patches
• Remove fix-standard-crypto-panic.patch (no longer needed)
• Add disable_static_tests_part1.patch and disable_static_tests_part2.patch to disable OpenSSL backend for static builds
• Add skip_TestCrashDumpsAllThreads.patch to skip flaky test on s390x architecture

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-34156 Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.CVE-2024-34158

These are all security issues fixed in the go1.22-1.22.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.23-1.23.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.56.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

Update to version 0.58.2 (

  boo#1234512, CVE-2024-45337,
  boo#1235265, CVE-2024-45338):

• fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)
• fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)
• fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)
• fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)
• fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)
• fix(sbom): use root package for unknown dependencies (if exists) [backport: release/v0.58] (#8156)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)
• fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)
• fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)
• chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)
• fix: handle BLOW_UNKNOWN error to download DBs [backport: release/v0.58] (#8121)
• fix(java): correctly overwrite version from depManagement if dependency uses project.* props [backport: release/v0.58] (#8119)
• release: v0.58.0 [main] (#7874)
• fix(misconf): wrap AWS EnvVar to iac types (#7407)
• chore(deps): Upgrade trivy-checks (#8018)
• refactor(misconf): Remove unused options (#7896)
• docs: add terminology page to explain Trivy concepts (#7996)
• feat: add workspaceRelationship (#7889)
• refactor(sbom): simplify relationship generation (#7985)
• docs: improve databases documentation (#7732)
• refactor: remove support for custom Terraform checks (#7901)
• docs: drop AWS account scanning (#7997)
• fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)
• fix(cli): Handle empty ignore files more gracefully (#7962)
• fix(misconf): load full Terraform module (#7925)
• fix(misconf): properly resolve local Terraform cache (#7983)
• refactor(k8s): add v prefix for Go packages (#7839)
• test: replace Go checks with Rego (#7867)
• feat(misconf): log causes of HCL file parsing errors (#7634)
• chore(deps): bump the aws group across 1 directory with 7 updates (#7991)
• chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)
• chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)
• chore: downgrade the failed block expand message to debug (#7964)
• fix(misconf): do not erase variable type for child modules (#7941)
• feat(go): construct dependencies of go.mod main module in the parser (#7977)
• feat(go): construct dependencies in the parser (#7973)
• feat: add cvss v4 score and vector in scan response (#7968)
• docs: add overview page for others (#7972)
• fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)
• feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)
• chore(deps): bump the common group with 4 updates (#7949)
• feat(oracle): add flavors support (#7858)
• fix(misconf): Update trivy-checks default repo to mirror.gcr.io (#7953)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• fix(k8s): check all results for vulnerabilities (#7946)
• ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)
• feat(secret): Add built-in secrets rules for Private Packagist (#7826)
• docs: Fix broken links (#7900)
• docs: fix mistakes/typos (#7942)
• feat: Update registry…

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)

• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)

• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)

• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)

• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)

• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)

• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)

• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)

• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

• Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for go1.22 fixes the following issues:

• Update to go v1.22.7
• CVE-2024-34155: Fixed stack exhaustion in all Parse* functions. (bsc#1230252)
• CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode. (bsc#1230253)
• CVE-2024-34158: Fixed stack exhaustion in Parse. (bsc#1230254)

This update for go1.23 fixes the following issues:

• Update go v1.23.1
• CVE-2024-34155: Fixed stack exhaustion in all Parse* functions. (bsc#1230252)
• CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode. (bsc#1230253)
• CVE-2024-34158: Fixed stack exhaustion in Parse. (bsc#1230254)

This update for go1.22 fixes the following issues:

• Update go v1.22.7
• CVE-2024-34155: Fixed stack exhaustion in all Parse* functions. (bsc#1230252)
• CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode. (bsc#1230253)
• CVE-2024-34158: Fixed stack exhaustion in Parse. (bsc#1230254)

This update for go1.23 fixes the following issues:

• Update go v1.23.1
• CVE-2024-34155: Fixed stack exhaustion in all Parse* functions. (bsc#1230252)
• CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode. (bsc#1230253)
• CVE-2024-34158: Fixed stack exhaustion in Parse. (bsc#1230254)

This update of kubernetes1.24 fixes the following issues:

• rebuild the package with the current go 1.23 security release (bsc#1229122).