Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:0603-1

Опубликовано: 02 мар. 2023
Источник: suse-cvrf

Описание

Security update for google-guest-agent

This update for google-guest-agent fixes the following issues:

Updated to version 20230222.00 (bsc#1202100, bsc#1202101) and bumped go API version to 1.18 to address the following (bsc#1208723):

  • CVE-2021-38297: Fixed data overwrite when passing large arguments to GOARCH=wasm GOOS=js (bsc#1191468).
  • CVE-2022-23806: Fixed Curve.IsOnCurve to incorrectly return true (bsc#1195838).

Bugfixes:

  • Avoid bashim in post install scripts (bsc#1195391).

Список пакетов

Image SLES12-SP5-GCE-BYOS
google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-On-Demand
google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-SAP-BYOS
google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-SAP-On-Demand
google-guest-agent-20230221.00-1.29.1
SUSE Linux Enterprise Module for Public Cloud 12
google-guest-agent-20230221.00-1.29.1

Ссылки

Описание

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Затронутые продукты
Image SLES12-SP5-GCE-BYOS:google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-On-Demand:google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-SAP-BYOS:google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-SAP-On-Demand:google-guest-agent-20230221.00-1.29.1
Ссылки

Описание

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

Затронутые продукты
Image SLES12-SP5-GCE-BYOS:google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-On-Demand:google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-SAP-BYOS:google-guest-agent-20230221.00-1.29.1
Image SLES12-SP5-GCE-SAP-On-Demand:google-guest-agent-20230221.00-1.29.1
Ссылки