CVE-2021-36221

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

The go programming language

Security Fix(es):

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.(CVE-2021-33195)

In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive s header) can cause a NewReader or OpenReader panic.(CVE-2021-33196)

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.(CVE-2021-33197)

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.(CVE-2021-33198)

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.(CVE-2021-34558)

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.(CVE-2021-29923)

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.(CVE-2021-38297)

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.(CVE-2021-36221)

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The following packages have been upgraded to a later upstream version: golang (1.16.7). (BZ#1938071)

Security Fix(es):

• golang: net: lookup functions may return invalid host names (CVE-2021-33195)

• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

• golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

• opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

• buildah: possible information disclosure and modification (CVE-2022-2990)

• runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The following packages have been upgraded to a later upstream version: golang (1.16.7). (BZ#1938071)

Security Fix(es):

• golang: net: lookup functions may return invalid host names (CVE-2021-33195)

• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

• golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

ReverseProxy can panic after encountering a problem copying a proxied response body.

The updated golang packages fix a security vulnerability:

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort (CVE-2021-36221).

This update for go1.16 fixes the following issues:

Update to go1.16.7:

• go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162)
• go#47348 cmd/go: 'go list -f '{{.Stale}}'' stack overflow with cyclic imports
• go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
• go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
• go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
• go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
• go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
• go#46551 cmd/go: unhelpful error message when running 'go install' on a replaced-but-not-required package

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.15 fixes the following issues:

Update to go1.15.15:

• go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162)
• go#47347 cmd/go: 'go list -f '{{.Stale}}'' stack overflow with cyclic imports
• go#47014 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
• go#46927 cmd/compile: register conflict between external linker and duffzero on arm64
• go#46857 runtime: ppc64x binaries randomly segfault on linux 5.13rc6

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.15 fixes the following issues:

Update to go1.15.15:

• go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162)
• go#47347 cmd/go: 'go list -f '{{.Stale}}'' stack overflow with cyclic imports
• go#47014 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
• go#46927 cmd/compile: register conflict between external linker and duffzero on arm64
• go#46857 runtime: ppc64x binaries randomly segfault on linux 5.13rc6

This update for go1.16 fixes the following issues:

Update to go1.16.7:

• go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162)
• go#47348 cmd/go: 'go list -f '{{.Stale}}'' stack overflow with cyclic imports
• go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
• go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
• go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
• go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
• go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
• go#46551 cmd/go: unhelpful error message when running 'go install' on a replaced-but-not-required package

These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.16-1.16.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.15 fixes the following issues:

Update to go1.15.15:

• go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162)
• go#47347 cmd/go: 'go list -f '{{.Stale}}'' stack overflow with cyclic imports
• go#47014 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
• go#46927 cmd/compile: register conflict between external linker and duffzero on arm64
• go#46857 runtime: ppc64x binaries randomly segfault on linux 5.13rc6

This update for go1.16 fixes the following issues:

Update to go1.16.7:

• go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162)
• go#47348 cmd/go: 'go list -f '{{.Stale}}'' stack overflow with cyclic imports
• go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
• go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
• go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
• go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
• go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
• go#46551 cmd/go: unhelpful error message when running 'go install' on a replaced-but-not-required package