CVE-2023-39321

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.(CVE-2025-4674)

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-46835)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line,…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.(CVE-2025-4674)

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-46835)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to…

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)

• golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

• golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect (CVE-2018-25091)

• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

• golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

• golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)

• golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

• golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

• golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)

• golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)

• urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)

• ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

• moby/buildkit: Possible race condition with accessing subpaths from cache mounts (CVE-2024-23650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)
• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

Security Fix(es):

• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)
• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)
• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.

Security Fix(es):

• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)
• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
• golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
• golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)
• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

• rebuild with newer golang to fix multiple security vulnerabilities:
• CVE-2023-24534: fix HTTP/2 rapid reset attack leading to denial of service
• CVE-2023-29400: fix HTTP/2 frame processing panic leading to denial of service
• CVE-2022-41725: fix HTTP/2 server connection handling causing premature closure
• CVE-2022-41724: fix HTTP/2 server connection misuse causing resource exhaustion
• CVE-2023-24538: fix HTTP/2 request handling causing denial of service
• CVE-2023-39322: fix HTTP/2 connection resource exhaustion and denial of service
• CVE-2023-24539: fix HTTP/2 request handling causing excessive memory consumption
• CVE-2023-39321: fix HTTP/2 frame processing causing panic and denial of service
• CVE-2024-24788: fix HTTP/2 connection handling causing denial of service
• CVE-2022-41723: fix HTTP/2 server connection handling causing resource exhaustion
• CVE-2023-45287: fix RSA-based TLS key exchange timing attack vulnerability
• CVE-2024-34156: fix HTTP/2 connection resource exhaustion and denial of service
• CVE-2023-24536: fix HTTP/2 request handling causing denial of service

• Rebuild with golang >= 1.22.5.tuxcare.els7 to fix CVE-2024-24790, CVE-2024-34156, CVE-2023-45288, CVE-2023-39322, CVE-2023-39321, CVE-2024-24788

• rebuild with newer golang to fix security vulnerabilities:
• CVE-2023-45287: fix RSA-based TLS key exchange timing attack vulnerability
• CVE-2024-24788: fix DNS resolver infinite loop causing denial of service
• CVE-2023-39321: fix QUIC post-handshake message processing causing panic and denial of service

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

This update introduces go1.21, including fixes for the following issues:

• go1.21.3 (released 2023-10-10) includes a security fix to the net/http package. Refs boo#1212475 go1.21 release tracking CVE-2023-39325 CVE-2023-44487

  • go#63427 go#63417 boo#1216109 security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work

• go1.21.2 (released 2023-10-05) includes one security fixes to the cmd/go package, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the runtime/metrics package. Refs boo#1212475 go1.21 release tracking CVE-2023-39323

  • go#63214 go#63211 boo#1215985 security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build
  • go#62464 runtime: 'traceback did not unwind completely'
  • go#62478 runtime/metrics: /gc/scan* metrics return zero
  • go#62505 plugin: variable not initialized properly
  • go#62506 cmd/compile: internal compiler error: InvertFlags should never make it to codegen v100 = InvertFlags v123
  • go#62509 runtime: scheduler change causes Delve's function call injection to fail intermittently
  • go#62537 runtime: 'fatal: morestack on g0' with PGO enabled on arm64
  • go#62598 cmd/link: issues with Apple's new linker in Xcode 15 beta
  • go#62668 cmd/compile: slow to compile 17,000 line switch statement?
  • go#62711 cmd/go: TestScript/gotoolchain_path fails if golang.org/dl/go1.21.1 is installed in the user's $PATH

• go1.21.1 (released 2023-09-06) includes four security fixes to the cmd/go, crypto/tls, and html/template packages, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the context, crypto/tls, encoding/gob, encoding/xml, go/types, net/http, os, and path/filepath packages. Refs boo#1212475 go1.21 release tracking CVE-2023-39318 CVE-2023-39319 CVE-2023-39320 CVE-2023-39321 CVE-2023-39322

  • go#62290 go#62266 boo#1215087 security: fix CVE-2023-39321 CVE-2023-39322 crypto/tls: panic when processing partial post-handshake message in QUICConn.HandleData
  • go#62394 go#62198 boo#1215086 security: fix CVE-2023-39320 cmd/go: go.mod toolchain directive allows arbitrary execution
  • go#62396 go#62196 boo#1215084 security: fix CVE-2023-39318 html/template: improper handling of HTML-like comments within script contexts
  • go#62398 go#62197 boo#1215085 security: fix CVE-2023-39319 html/template: improper handling of special tags within script contexts
  • go#61743 go/types: interface.Complete panics for interfaces with duplicate methods
  • go#61781 cmd/compile: internal compiler error: 'f': value .autotmp_1 (nil) incorrectly live at entry
  • go#61818 cmd/go: panic: runtime error: index out of range [-1] in collectDepsErrors
  • go#61821 runtime/internal/wasitest: TestTCPEcho is racy
  • go#61868 path/filepath: Clean on some invalid Windows paths can lose .. components
  • go#61904 net/http: go 1.20.6 host validation breaks setting Host to a unix socket address
  • go#61905 cmd/go: go get/mod tidy panics with internal error: net token acquired but not released
  • go#61909 cmd/compile: internal compiler error: missed typecheck
  • go#61910 os: ReadDir fails on file systems without File ID support on Windows
  • go#61927 cmd/distpack: release archives don't include directory members
  • go#61930 spec, go/types, types2: restore Go 1.20 unification when compiling for Go 1.20
  • go#61932 go/types, types2: index out of range panic in Checker.arguments
  • go#61958 cmd/compile: write barrier code is sometimes preemptible when compiled with -N
  • go#61959 go/types, types2: panic: infinite recursion in unification with go1.21.0
  • go#61964 os: ReadDir(\.\pipe) fails with go1.21 on Windows
  • go#61967 crypto/tls: add GODEBUG to control max RSA key size
  • go#61987 runtime: simple programs crash on linux/386 with go1.21 when build with -gcflags='all=-N -l'
  • go#62019 runtime: execution halts with goroutines stuck in runtime.gopark…

These are all security issues fixed in the go1.21-1.21.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.21 fixes the following issues:

Update to go1.21.1 (bsc#1212475).

• CVE-2023-39318: Fixed improper handling of HTML-like comments within script contexts in html/template (bsc#1215084).
• CVE-2023-39319: Fixed improper handling of special tags within script contexts in html/template (bsc#1215085).
• CVE-2023-39320: Fixed arbitrary execution in go.mod toolchain directive (bsc#1215086).
• CVE-2023-39321, CVE-2023-39322: Fixed a panic when processing post-handshake message on QUIC connections in crypto/tls (bsc#1215087).

The following non-security bug was fixed:

• Add missing directory pprof html asset directory to package (bsc#1215090).

This update for go1.21-openssl fixes the following issues:

Update to version 1.21.4.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.4-1-openssl-fips.

• Update to go1.21.4

go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages.

• security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
• spec: update unification rules
• cmd/compile: internal compiler error: expected struct value to have type struct
• cmd/link: split text sections for arm 32-bit
• runtime: MADV_COLLAPSE causes production performance issues on Linux
• go/types, x/tools/go/ssa: panic: type param without replacement encountered
• cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64
• net/http: http2 page fails on firefox/safari if pushing resources

Initial package go1.21-openssl version 1.21.3.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.3-1-openssl-fips. (jsc#SLE-18320)

• Go upstream merged branch dev.boringcrypto in go1.19+.
• In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.
• In go1.x-openssl enable FIPS mode (or boring mode as the package is named) either via an environment variable GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.
• When the operating system is operating in FIPS mode, Go applications which import crypto/tls/fipsonly limit operations to the FIPS ciphersuite.
• go1.x-openssl is delivered as two large patches to go1.x applying necessary modifications from the golang-fips/go GitHub project for the Go crypto library to use OpenSSL as the external cryptographic library in a FIPS compliant way.
• go1.x-openssl modifies the crypto/* packages to use OpenSSL for cryptographic operations.
• go1.x-openssl uses dlopen() to call into OpenSSL.
• SUSE RPM packaging introduces a fourth version digit go1.x.y.z corresponding to the golang-fips/go patchset tagged revision.
• Patchset improvements can be updated independently of upstream Go maintenance releases.