CVE-2020-24553

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response.

The Content-Type header is now set based on the contents of the first Write using http.DetectContentType, which is consistent with the behavior of the net/http package.

Although this protects some applications that validate the contents of uploaded files, not setting the Content-Type header explicitly on any attacker-controlled file is unsafe and should be avoided.

A flaw was found in Go standard library packages. Both the net/http/cgi and net/http/fcgi packages use a default Content-Type response header value of "text/html", rather than "text/plain". An attacker could exploit this in applications using these packages by uploading crafted files, allowing for a cross-site scripting attack (XSS) (CVE-2020-24553).

This update for go1.14 fixes the following issues:

• go1.14.9 (released 2020-09-09) includes fixes to the compiler, linker, runtime, documentation, and the net/http and testing packages. Refs bsc#1164903 go1.14 release tracking

  • go#41192 net/http/fcgi: race detected during execution of TestResponseWriterSniffsContentType test
  • go#41016 net/http: Transport.CancelRequest no longer cancels in-flight request
  • go#40973 net/http: RoundTrip unexpectedly changes Request
  • go#40968 runtime: checkptr incorrectly -race flagging when using &^ arithmetic
  • go#40938 cmd/compile: R12 can be clobbered for write barrier call on PPC64
  • go#40848 testing: '=== PAUSE' lines do not change the test name for the next log line
  • go#40797 cmd/compile: inline marker targets not reachable after assembly on arm
  • go#40766 cmd/compile: inline marker targets not reachable after assembly on ppc64x
  • go#40501 cmd/compile: for range loop reading past slice end
  • go#40411 runtime: Windows service lifecycle events behave incorrectly when called within a golang environment
  • go#40398 runtime: fatal error: checkdead: runnable g
  • go#40192 runtime: pageAlloc.searchAddr may point to unmapped memory in discontiguous heaps, violating its invariant
  • go#39955 cmd/link: incorrect GC bitmap when global's type is in another shared object
  • go#39690 cmd/compile: s390x floating point <-> integer conversions clobbering the condition code
  • go#39279 net/http: Re-connect with upgraded HTTP2 connection fails to send Request.body
  • go#38904 doc: include fix for #34437 in Go 1.14 release notes

• go1.14.8 (released 2020-09-01) includes security fixes to the net/http/cgi and net/http/fcgi packages. CVE-2020-24553 Refs bsc#1164903 go1.14 release tracking

  • bsc#1176031 CVE-2020-24553
  • go#41164 net/http/cgi,net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.14 fixes the following issues:

• go1.14.9 (released 2020-09-09) includes fixes to the compiler, linker, runtime, documentation, and the net/http and testing packages. Refs bsc#1164903 go1.14 release tracking

  • go#41192 net/http/fcgi: race detected during execution of TestResponseWriterSniffsContentType test
  • go#41016 net/http: Transport.CancelRequest no longer cancels in-flight request
  • go#40973 net/http: RoundTrip unexpectedly changes Request
  • go#40968 runtime: checkptr incorrectly -race flagging when using &^ arithmetic
  • go#40938 cmd/compile: R12 can be clobbered for write barrier call on PPC64
  • go#40848 testing: '=== PAUSE' lines do not change the test name for the next log line
  • go#40797 cmd/compile: inline marker targets not reachable after assembly on arm
  • go#40766 cmd/compile: inline marker targets not reachable after assembly on ppc64x
  • go#40501 cmd/compile: for range loop reading past slice end
  • go#40411 runtime: Windows service lifecycle events behave incorrectly when called within a golang environment
  • go#40398 runtime: fatal error: checkdead: runnable g
  • go#40192 runtime: pageAlloc.searchAddr may point to unmapped memory in discontiguous heaps, violating its invariant
  • go#39955 cmd/link: incorrect GC bitmap when global's type is in another shared object
  • go#39690 cmd/compile: s390x floating point <-> integer conversions clobbering the condition code
  • go#39279 net/http: Re-connect with upgraded HTTP2 connection fails to send Request.body
  • go#38904 doc: include fix for #34437 in Go 1.14 release notes

• go1.14.8 (released 2020-09-01) includes security fixes to the net/http/cgi and net/http/fcgi packages. CVE-2020-24553 Refs bsc#1164903 go1.14 release tracking

  • bsc#1176031 CVE-2020-24553
  • go#41164 net/http/cgi,net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the go1.14-1.14.15-1.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed.

This update for go1.14 fixes the following issues:

• go1.14.9 (released 2020-09-09) includes fixes to the compiler, linker, runtime, documentation, and the net/http and testing packages. Refs bsc#1164903 go1.14 release tracking

  • go#41192 net/http/fcgi: race detected during execution of TestResponseWriterSniffsContentType test
  • go#41016 net/http: Transport.CancelRequest no longer cancels in-flight request
  • go#40973 net/http: RoundTrip unexpectedly changes Request
  • go#40968 runtime: checkptr incorrectly -race flagging when using &^ arithmetic
  • go#40938 cmd/compile: R12 can be clobbered for write barrier call on PPC64
  • go#40848 testing: '=== PAUSE' lines do not change the test name for the next log line
  • go#40797 cmd/compile: inline marker targets not reachable after assembly on arm
  • go#40766 cmd/compile: inline marker targets not reachable after assembly on ppc64x
  • go#40501 cmd/compile: for range loop reading past slice end
  • go#40411 runtime: Windows service lifecycle events behave incorrectly when called within a golang environment
  • go#40398 runtime: fatal error: checkdead: runnable g
  • go#40192 runtime: pageAlloc.searchAddr may point to unmapped memory in discontiguous heaps, violating its invariant
  • go#39955 cmd/link: incorrect GC bitmap when global's type is in another shared object
  • go#39690 cmd/compile: s390x floating point <-> integer conversions clobbering the condition code
  • go#39279 net/http: Re-connect with upgraded HTTP2 connection fails to send Request.body
  • go#38904 doc: include fix for #34437 in Go 1.14 release notes

• go1.14.8 (released 2020-09-01) includes security fixes to the net/http/cgi and net/http/fcgi packages. CVE-2020-24553 Refs bsc#1164903 go1.14 release tracking

  • bsc#1176031 CVE-2020-24553
  • go#41164 net/http/cgi,net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified

go1.15 (released 2020-08-11) Go 1.15 is a major release of Go.

go1.15.x minor releases will be provided through August 2021.

https://github.com/golang/go/wiki/Go-Release-Cycle

Most changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before.

• See release notes https://golang.org/doc/go1.15. Excerpts relevant to OBS environment and for SUSE/openSUSE follow:
• Module support in the go command is ready for production use, and we encourage all users to migrate to Go modules for dependency management.
• Module cache: The location of the module cache may now be set with the GOMODCACHE environment variable. The default value of GOMODCACHE is GOPATH[0]/pkg/mod, the location of the module cache before this change.
• Compiler flag parsing: Various flag parsing issues in go test and go vet have been fixed. Notably, flags specified in GOFLAGS are handled more consistently, and the -outputdir flag now interprets relative paths relative to the working directory of the go command (rather than the working directory of each individual test).
• The GOPROXY environment variable now supports skipping proxies that return errors. Proxy URLs may now be separated with either commas (,) or pipe characters (|). If a proxy URL is followed by a comma, the go command will only try the next proxy in the list after a 404 or 410 HTTP response. If a proxy URL is followed by a pipe character, the go command will try the next proxy in the list after any error. Note that the default value of GOPROXY remains https://proxy.golang.org,direct, which does not fall back to direct in case of errors.
• On a Unix system, if the kill command or kill system call is used to send a SIGSEGV, SIGBUS, or SIGFPE signal to a Go program, and if the signal is not being handled via os/signal.Notify, the Go program will now reliably crash with a stack trace. In earlier releases the behavior was unpredictable.
• Allocation of small objects now performs much better at high core counts, and has lower worst-case latency.
• Go 1.15 reduces typical binary sizes by around 5% compared to Go 1.14 by eliminating certain types of GC metadata and more aggressively eliminating unused type metadata.
• The toolchain now mitigates Intel CPU erratum SKX102 on GOARCH=amd64 by aligning functions to 32 byte boundaries and padding jump instructions. While this padding increases binary sizes, this is more than made up for by the binary size improvements mentioned above.
• Go 1.15 adds a -spectre flag to both the compiler and the assembler, to allow enabling Spectre mitigations. These should almost never be needed and are provided mainly as a 'defense in depth' mechanism. See the Spectre Go wiki page for details.
• The compiler now rejects //go: compiler directives that have no meaning for the declaration they are applied to with a 'misplaced compiler directive' error. Such misapplied directives were broken before, but were silently ignored by the compiler.
• Substantial improvements to the Go linker, which reduce linker resource usage (both time and memory) and improve code robustness/maintainability. Linking is 20% faster and requires 30% less memory on average. These changes are part of a multi-release project to modernize the Go linker, meaning that there will be additional linker improvements expected in future releases.
• The linker now defaults to internal linking mode for -buildmode=pie on linux/amd64 and linux/arm64, so these configurations no longer require a C linker.
• There has been progress in improving the stability and performance of the 64-bit RISC-V port on Linux (GOOS=linux, GOARCH=riscv64). It also now supports asynchronous preemption.
• crypto/x509: The deprecated, legacy behavior of treating the CommonName field on…

It was discovered that Go applications incorrectly handled uploaded content. If a user were tricked into visiting a malicious page, a remote attacker could exploit this with a crafted file to conduct cross-site scripting (XSS) attacks.