Описание
Security update for go1.18
This update for go1.18 fixes the following issues:
Update to go version 1.18.5 (bsc#1193742):
- CVE-2022-32189: encoding/gob, math/big: decoding big.Float and big.Rat can panic (bsc#1202035).
- CVE-2022-1705: net/http: improper sanitization of Transfer-Encoding header (bsc#1201434)
- CVE-2022-32148: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (bsc#1201436)
- CVE-2022-30631: compress/gzip: stack exhaustion in Reader.Read (bsc#1201437).
- CVE-2022-30633: encoding/xml: stack exhaustion in Unmarshal (bsc#1201440).
- CVE-2022-28131: encoding/xml: stack exhaustion in Decoder.Skip (bsc#1201443).
- CVE-2022-30635: encoding/gob: stack exhaustion in Decoder.Decode (bsc#1201444).
- CVE-2022-30632: path/filepath: stack exhaustion in Glob (bsc#1201445).
- CVE-2022-30630: io/fs: stack exhaustion in Glob (bsc#1201447).
- CVE-2022-1962: go/parser: stack exhaustion in all Parse* functions (bsc#1201448).
Список пакетов
Container bci/golang:1.18
SUSE Linux Enterprise Module for Development Tools 15 SP3
SUSE Linux Enterprise Module for Development Tools 15 SP4
openSUSE Leap 15.3
openSUSE Leap 15.4
Ссылки
- Link for SUSE-SU-2022:2672-1
- E-Mail link for SUSE-SU-2022:2672-1
- SUSE Security Ratings
- SUSE Bug 1193742
- SUSE Bug 1201434
- SUSE Bug 1201436
- SUSE Bug 1201437
- SUSE Bug 1201440
- SUSE Bug 1201443
- SUSE Bug 1201444
- SUSE Bug 1201445
- SUSE Bug 1201447
- SUSE Bug 1201448
- SUSE Bug 1202035
- SUSE CVE CVE-2022-1705 page
- SUSE CVE CVE-2022-1962 page
- SUSE CVE CVE-2022-28131 page
- SUSE CVE CVE-2022-30630 page
- SUSE CVE CVE-2022-30631 page
- SUSE CVE CVE-2022-30632 page
Описание
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
Затронутые продукты
Ссылки
- CVE-2022-1705
- SUSE Bug 1201434
Описание
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.
Затронутые продукты
Ссылки
- CVE-2022-1962
- SUSE Bug 1201448
Описание
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
Затронутые продукты
Ссылки
- CVE-2022-28131
- SUSE Bug 1201443
Описание
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
Затронутые продукты
Ссылки
- CVE-2022-30630
- SUSE Bug 1201447
Описание
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
Затронутые продукты
Ссылки
- CVE-2022-30631
- SUSE Bug 1201437
Описание
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
Затронутые продукты
Ссылки
- CVE-2022-30632
- SUSE Bug 1201445
Описание
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
Затронутые продукты
Ссылки
- CVE-2022-30633
- SUSE Bug 1201440
Описание
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
Затронутые продукты
Ссылки
- CVE-2022-30635
- SUSE Bug 1201444
Описание
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
Затронутые продукты
Ссылки
- CVE-2022-32148
- SUSE Bug 1201436
Описание
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
Затронутые продукты
Ссылки
- CVE-2022-32189
- SUSE Bug 1202035